{
  "ml": {
    "v": "4",
    "fs": [
      {
        "id": 0,
        "prob": 0.02936241589486599,
        "class": 0
      }
    ],
    "prob": 0.029362416,
    "class": 0,
    "models": [
      {
        "m": "az",
        "prob": 0.029362416,
        "class": 0
      },
      {
        "m": "az/native",
        "prob": 0.0,
        "class": 0
      },
      {
        "m": "az/pe",
        "prob": 0.0,
        "class": 0
      }
    ],
    "version": "v17.17",
    "thresholds": [
      0.999503,
      0.9998882
    ],
    "analyzed_at": "2026-05-25T16:03:04Z"
  },
  "path": "VirusShare_77504b0e01a79318fbcf6df6ea022d16",
  "raw": {
    "v": "5",
    "fs": [
      {
        "f": "Md₂(BiSi)",
        "x": 5,
        "ff": {
          "m": {
            "pe": {
              "checksum": 54464.0,
              "checksum_valid": 1.0,
              "resource_count": 1.0,
              "has_version_info": 1.0,
              "computed_checksum": 54464.0,
              "bss_like_section_count": 0.0,
              "forwarded_export_count": 8.0,
              "section_overflow_count": 0.0,
              "misaligned_section_count": 0.0
            },
            "file": {
              "size": 8888.0,
              "entropy": 6.45,
              "size_bytes": 8888.0
            },
            "binary": {
              "is_pie": 1.0,
              "has_overlay": 1.0,
              "code_entropy": 3.94,
              "overlay_size": 5816.0,
              "string_count": 163.0,
              "overlay_ratio": 0.65,
              "overlay_entropy": 7.4,
              "entropy_variance": 0.12,
              "avg_string_length": 15.28,
              "max_string_length": 49.0,
              "code_to_data_ratio": 1.0,
              "string_length_stddev": 11.34,
              "largest_section_ratio": 0.12,
              "sentence_string_count": 16.0,
              "sentence_string_ratio": 0.1,
              "high_entropy_string_count": 0.0
            },
            "exports": {
              "count": 8.0
            },
            "sections": {
              "count": 2.0,
              "code_size": 1024.0,
              "entropy_max": 3.94,
              "entropy_mean": 3.59,
              "name_entropy": 2.72,
              "writable_count": 0.0,
              "executable_count": 1.0,
              "nonstandard_count": 0.0,
              "executable_writable_count": 0.0
            },
            "dependencies": {
              "count": 0.0
            }
          },
          "s": [
            [
              77,
              "u8",
              "!This program cannot be run in DOS mode."
            ],
            [
              456,
              "u8",
              ".text"
            ],
            [
              1108,
              "u8",
              "RSDS"
            ],
            [
              1132,
              "u8",
              "api-ms-win-core-string-l1-1-0.pdb"
            ],
            [
              1200,
              "u8",
              ".rdata"
            ],
            [
              1216,
              "u8",
              ".rdata$zzzdbg"
            ],
            [
              1240,
              "u8",
              ".edata"
            ],
            [
              1416,
              "u8",
              "api-ms-win-core-string-l1-1-0.dll"
            ],
            [
              1450,
              "u8",
              "CompareStringEx"
            ],
            [
              1466,
              "u8",
              "kernel32.CompareStringEx"
            ],
            [
              1491,
              "u8",
              "CompareStringOrdinal"
            ],
            [
              1512,
              "u8",
              "kernel32.CompareStringOrdinal"
            ],
            [
              1542,
              "u8",
              "CompareStringW"
            ],
            [
              1557,
              "u8",
              "kernel32.CompareStringW"
            ],
            [
              1581,
              "u8",
              "FoldStringW"
            ],
            [
              1593,
              "u8",
              "kernel32.FoldStringW"
            ],
            [
              1614,
              "u8",
              "GetStringTypeExW"
            ],
            [
              1631,
              "u8",
              "kernel32.GetStringTypeExW"
            ],
            [
              1657,
              "u8",
              "GetStringTypeW"
            ],
            [
              1672,
              "u8",
              "kernel32.GetStringTypeW"
            ],
            [
              1696,
              "u8",
              "MultiByteToWideChar"
            ],
            [
              1716,
              "u8",
              "kernel32.MultiByteToWideChar"
            ],
            [
              1745,
              "u8",
              "WideCharToMultiByte"
            ],
            [
              1765,
              "u8",
              "kernel32.WideCharToMultiByte"
            ],
            [
              2150,
              "wide",
              "VS_VERSION_INFO"
            ],
            [
              2242,
              "wide",
              "StringFileInfo"
            ],
            [
              2278,
              "wide",
              "040904B0"
            ],
            [
              2302,
              "wide",
              "CompanyName"
            ],
            [
              2328,
              "wide",
              "Microsoft Corporation"
            ],
            [
              2378,
              "wide",
              "FileDescription"
            ],
            [
              2412,
              "wide",
              "ApiSet Stub DLL"
            ],
            [
              2450,
              "wide",
              "FileVersion"
            ],
            [
              2546,
              "wide",
              "InternalName"
            ],
            [
              2572,
              "wide",
              "apisetstub"
            ],
            [
              2602,
              "wide",
              "LegalCopyright"
            ],
            [
              2632,
              "wide",
              "© Microsoft Corporation. All rights reserved."
            ],
            [
              2730,
              "wide",
              "OriginalFilename"
            ],
            [
              2794,
              "wide",
              "ProductName"
            ],
            [
              2820,
              "wide",
              "Microsoft® Windows® Operating System"
            ],
            [
              2902,
              "wide",
              "ProductVersion"
            ],
            [
              2966,
              "wide",
              "VarFileInfo"
            ],
            [
              2998,
              "wide",
              "Translation"
            ],
            [
              3134,
              "u8",
              "Z0X03"
            ],
            [
              3302,
              "u8",
              "Western Cape1"
            ],
            [
              3325,
              "u8",
              "Durbanville1"
            ],
            [
              3347,
              "u8",
              "Thawte1"
            ],
            [
              3364,
              "u8",
              "Thawte Certification1"
            ],
            [
              3395,
              "u8",
              "Thawte Timestamping CA0"
            ],
            [
              3475,
              "u8",
              "Symantec Corporation100."
            ],
            [
              3505,
              "u8",
              "'Symantec Time Stamping Services CA - G20"
            ],
            [
              3906,
              "u8",
              "http://ocsp.thawte.com0"
            ],
            [
              3956,
              "u8",
              "80604"
            ],
            [
              3966,
              "u8",
              ".http://crl.thawte.com/ThawteTimestampingCA.crl0"
            ],
            [
              4076,
              "u8",
              "TimeStamp-2048-10"
            ],
            [
              4312,
              "u8",
              "thawte, Inc.1(0\u0026"
            ],
            [
              4335,
              "u8",
              "Certification Services Division1806"
            ],
            [
              4376,
              "u8",
              "/(c) 2006 thawte, Inc. - For authorized use only1"
            ],
            [
              4435,
              "u8",
              "thawte Primary Root CA0"
            ],
            [
              4476,
              "u8",
              "231209235959Z0L1"
            ],
            [
              4515,
              "u8",
              "thawte, Inc.1\u00260$"
            ],
            [
              4538,
              "u8",
              "thawte SHA256 Code Signing CA0"
            ],
            [
              4899,
              "u8",
              "http://t2.symcb.com0"
            ],
            [
              4956,
              "u8",
              "!http://t1.symcb.com/ThawtePCA.crl0"
            ],
            [
              5063,
              "u8",
              "SymantecPKI-1-5680"
            ],
            [
              5141,
              "u8",
              "WHP0"
            ],
            [
              5365,
              "u8",
              "EArWu"
            ],
            [
              5581,
              "u8",
              "201229235959Z0b1"
            ],
            [
              5620,
              "u8",
              "Symantec Corporation1402"
            ],
            [
              5650,
              "u8",
              "+Symantec Time Stamping Services Signer - G40"
            ],
            [
              6080,
              "u8",
              "http://ts-ocsp.ws.symantec.com07"
            ],
            [
              6123,
              "u8",
              "+http://ts-aia.ws.symantec.com/tss-ca-g2.cer0\u003c"
            ],
            [
              6175,
              "u8",
              "50301"
            ],
            [
              6185,
              "u8",
              "+http://ts-crl.ws.symantec.com/tss-ca-g2.crl0("
            ],
            [
              6255,
              "u8",
              "TimeStamp-2048-20"
            ],
            [
              6364,
              "u8",
              "b07x"
            ],
            [
              6754,
              "u8",
              "171013235959Z0"
            ],
            [
              6794,
              "u8",
              "Beijing1"
            ],
            [
              6830,
              "u8",
              "No Organization Affiliation1"
            ],
            [
              6868,
              "u8",
              "Individual Developer1"
            ],
            [
              6899,
              "u8",
              "Mengmeng Wang0"
            ],
            [
              7308,
              "u8",
              "http://tl.symcb.com/tl.crl0"
            ],
            [
              7379,
              "u8",
              "g0e0c"
            ],
            [
              7408,
              "u8",
              "https://www.thawte.com/cps0/"
            ],
            [
              7449,
              "u8",
              "!https://www.thawte.com/repository0W"
            ],
            [
              7496,
              "u8",
              "K0I0"
            ],
            [
              7513,
              "u8",
              "http://tl.symcd.com0\u0026"
            ],
            [
              7546,
              "u8",
              "http://tl.symcb.com/tl.crt0"
            ],
            [
              7910,
              "u8",
              "thawte SHA256 Code Signing CA"
            ],
            [
              8445,
              "u8",
              "'Symantec Time Stamping Services CA - G2"
            ]
          ],
          "v": {
            "pe.machine": "i386",
            "pe.rich.key": 2444448553,
            "pe.rich.hash": "669f3a9d65babc7aaa2f6b3ff663994a",
            "pe.subsystem": "windows_cui",
            "pe.timestamp": 1433321554,
            "pe.image_base": 268435456,
            "pe.image_size": 12288,
            "pe.machine_id": 332,
            "pe.os_version": "10.0",
            "pe.version.os": "windows_nt_windows32",
            "pe.headers_size": 1024,
            "pe.version.type": "dll",
            "pe.debug.pdb.age": 1,
            "pe.subsystem_raw": 3,
            "pe.debug.pdb.guid": "87ab17dc-a492-4170-a283-81054cfcaeaf",
            "pe.debug.pdb.path": "api-ms-win-core-string-l1-1-0.pdb",
            "pe.file_alignment": 512,
            "pe.cert_table_size": 5816,
            "pe.image_hash.sha1": "b67fa018745bc1bb41f0d88afd16cf2a854b0414",
            "pe.version.company": "Microsoft Corporation",
            "pe.export_timestamp": 1433315180,
            "pe.image_hash.sha256": "58b6ec15636934e1f0579d641a73fbadc9e86eaced058df5ed0b09bcac8317c2",
            "pe.image_hash.sha384": "1e9eba60d3ce03563543fb013dbc5780e9adb551230855b045bbc03a19064ad3ee9bc98b8310e1f358cc2418c0eb1611",
            "pe.image_hash.sha512": "47cfe74e8b707db369da4ef61b034b691a206ed285c8da7f618bda0a267188325906b12c0a85040363c5c8434814a1b85022a1bbaf532e38910b15ab22c9ddac",
            "pe.resource_types[0]": "RT_VERSION",
            "pe.section_alignment": 4096,
            "pe.subsystem_version": "10.0",
            "pe.version.copyright": "© Microsoft Corporation. All rights reserved.",
            "pe.characteristics[0]": "executable_image",
            "pe.characteristics[1]": "32bit_machine",
            "pe.characteristics[2]": "dll",
            "pe.characteristics_raw": 8450,
            "pe.debug.pdb.timestamp": 1433321554,
            "pe.version.description": "ApiSet Stub DLL",
            "pe.linker_major_version": 12,
            "pe.linker_minor_version": 10,
            "pe.signatures[0].issuer": "CN=thawte SHA256 Code Signing CA,O=thawte\\, Inc.,C=US",
            "pe.signatures[0].serial": "57fcdab4b0c6202bc89a0ddd4a742960",
            "pe.version.file_version": "10.0.10137.0 (th1.150602-2238)",
            "pe.version.product_name": "Microsoft® Windows® Operating System",
            "build.toolchain.compiler": "msvc",
            "pe.debug.entries[0].type": "codeview",
            "pe.debug.entries[1].type": "pogo",
            "pe.signatures[0].subject": "CN=Mengmeng Wang,OU=Individual Developer,O=No Organization Affiliation,L=Beijing,ST=Beijing,C=CN",
            "pe.version.internal_name": "apisetstub",
            "pe.dll_characteristics[0]": "dynamic_base",
            "pe.dll_characteristics[1]": "nx_compat",
            "pe.dll_characteristics[2]": "no_seh",
            "pe.signatures[0].verified": true,
            "pe.data_directories[0].rva": 4368,
            "pe.data_directories[1].rva": 8192,
            "pe.data_directories[2].rva": 3072,
            "pe.data_directories[3].rva": 4096,
            "pe.dll_characteristics_raw": 1344,
            "pe.number_of_rva_and_sizes": 16,
            "pe.signatures[0].not_after": "2017-10-13T23:59:59Z",
            "pe.version.product_version": "10.0.10137.0",
            "pe.data_directories[0].name": "export",
            "pe.data_directories[0].size": 498,
            "pe.data_directories[1].name": "resource",
            "pe.data_directories[1].size": 984,
            "pe.data_directories[2].name": "certificate",
            "pe.data_directories[2].size": 5816,
            "pe.data_directories[3].name": "debug",
            "pe.data_directories[3].size": 56,
            "pe.debug.entries[0].type_id": 2,
            "pe.debug.entries[1].type_id": 13,
            "pe.rich.entries[0].build_id": 238,
            "pe.rich.entries[1].build_id": 242,
            "pe.rich.entries[2].build_id": 237,
            "pe.rich.entries[3].build_id": 240,
            "pe.signatures[0].not_before": "2016-10-14T00:00:00Z",
            "pe.rich.entries[0].use_count": 1,
            "pe.rich.entries[1].use_count": 2,
            "pe.rich.entries[2].use_count": 1,
            "pe.rich.entries[3].use_count": 1,
            "pe.version.original_filename": "apisetstub",
            "pe.coff.dos_header_pe_pointer": 208,
            "pe.rich.entries[0].product_id": 40116,
            "pe.rich.entries[1].product_id": 40116,
            "pe.rich.entries[2].product_id": 40116,
            "pe.rich.entries[3].product_id": 40116,
            "pe.debug.entries[0].size_bytes": 58,
            "pe.debug.entries[1].size_bytes": 100,
            "pe.signatures[0].thumbprint_sha1": "a659c4fdf054ffb193b2f060c6456804a6043162",
            "pe.signatures[0].cert_chain_depth": 4,
            "pe.signatures[0].digest_algorithm": "sha1",
            "pe.signatures[0].eku_code_signing": true,
            "pe.signatures[0].signature_digest": "b67fa018745bc1bb41f0d88afd16cf2a854b0414",
            "pe.debug.entries[0].timestamp_unix": 1433321554,
            "pe.debug.entries[1].timestamp_unix": 1433321554,
            "pe.signatures[0].thumbprint_sha256": "af77e7db87a3005b1f44b8f8f4bda3501706fe901f405eaf466bd26e53ab1792",
            "pe.signatures[0].signature_algorithm": "sha256WithRSAEncryption",
            "pe.signatures[0].signature_digest_algorithm": "sha1"
          },
          "x": [
            [
              "CompareStringEx",
              "kernel32.CompareStringEx"
            ],
            [
              "CompareStringOrdinal",
              "kernel32.CompareStringOrdinal"
            ],
            [
              "CompareStringW",
              "kernel32.CompareStringW"
            ],
            [
              "FoldStringW",
              "kernel32.FoldStringW"
            ],
            [
              "GetStringTypeExW",
              "kernel32.GetStringTypeExW"
            ],
            [
              "GetStringTypeW",
              "kernel32.GetStringTypeW"
            ],
            [
              "MultiByteToWideChar",
              "kernel32.MultiByteToWideChar"
            ],
            [
              "WideCharToMultiByte",
              "kernel32.WideCharToMultiByte"
            ]
          ],
          "id": "pe",
          "sc": [
            [
              ".text",
              1024,
              1024,
              3.94,
              "r-x"
            ],
            [
              ".rsrc",
              2048,
              1024,
              3.24,
              "r--"
            ]
          ]
        },
        "id": 0,
        "sz": 8888,
        "ts": [
          {
            "c": 1.0,
            "d": "Authenticode chain CN: Mengmeng Wang",
            "e": [
              "Mengmeng Wang"
            ],
            "i": "metadata/signed/unknown::mengmeng-wang",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "Signed by No Organization Affiliation",
            "e": [
              "No Organization Affiliation"
            ],
            "i": "metadata/signed/leaf::no-organization-affiliation",
            "l": 3
          },
          {
            "c": 0.8999999761581421,
            "d": "PE resource section",
            "e": [
              ".rsrc"
            ],
            "i": "metadata/binary/section/names::pe-resource-section",
            "l": 1
          },
          {
            "c": 0.949999988079071,
            "d": "PE version info numeric fields present",
            "e": [
              "10.0.10137.0 (th1.150602-2238)"
            ],
            "i": "metadata/binary/anomaly/format::version-info-file-version-present",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "PE Authenticode signature verified metadata",
            "e": [
              "true"
            ],
            "i": "metadata/signed/certificate::pe-signature-verified-kv",
            "l": 2
          },
          {
            "c": 0.9700000286102295,
            "d": "Microsoft ImageHlp company metadata",
            "e": [
              "Microsoft Corporation"
            ],
            "i": "well-known/lib/microsoft-imagehlp::imagehlp-company",
            "l": 2
          },
          {
            "a": "T1036.005",
            "c": 0.8999999761581421,
            "d": "Microsoft Corporation company in version info",
            "e": [
              "Microsoft Corporation"
            ],
            "i": "objectives/evasion/masquerade/version-resource/microsoft-utility::dw20-microsoft-company",
            "l": 1,
            "m": "F0004"
          },
          {
            "c": 0.8999999761581421,
            "d": "PE standard code/data section",
            "e": [
              ".text"
            ],
            "i": "metadata/binary/section/names::pe-code-data-standard-section",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Binary has 4 or fewer sections",
            "e": [
              "sections.count = 2.00"
            ],
            "i": "objectives/command-and-control/infrastructure/config::max-sections-4",
            "l": 1
          },
          {
            "c": 0.699999988079071,
            "d": "PE InternalName metadata field",
            "e": [
              "InternalName"
            ],
            "i": "metadata/package/versioning::pe-internalname-field",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "PE checksum matches computed value",
            "e": [
              "pe.checksum_valid = 1.00"
            ],
            "i": "metadata/binary/layout::pe-checksum-valid",
            "l": 1
          },
          {
            "c": 0.699999988079071,
            "d": "PE CompanyName metadata field",
            "e": [
              "CompanyName"
            ],
            "i": "metadata/package/versioning::pe-companyname-field",
            "l": 2
          },
          {
            "c": 0.8999999761581421,
            "d": "DLL exports five to ten APIs",
            "e": [
              "exports.count = 8.00"
            ],
            "i": "metadata/binary/symbols/exports::sideload-export-cluster-size-5-10",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "PE binary has trailing overlay data",
            "e": [
              "binary.has_overlay = 1.00"
            ],
            "i": "metadata/binary/layout::has-overlay",
            "l": 3
          },
          {
            "a": "T1204.002",
            "c": 0.7599999904632568,
            "d": "Short PDB marker",
            "e": [
              "api-ms-win-core-string-l1-1-0.pdb"
            ],
            "i": "objectives/command-and-control/dropper/execution/clickfix::short-pdb-marker",
            "l": 1,
            "m": "B0024"
          },
          {
            "d": ".dll extension reference",
            "e": [
              ".dll"
            ],
            "i": "micro-behaviors/fs/path/extension::dll-dup",
            "l": 2
          },
          {
            "c": 0.949999988079071,
            "d": "PE FileDescription field is populated",
            "e": [
              "ApiSet Stub DLL"
            ],
            "i": "metadata/package/versioning::pe-file-description-present",
            "l": 1
          },
          {
            "c": 0.699999988079071,
            "d": "PE OriginalFilename metadata field",
            "e": [
              "OriginalFilename"
            ],
            "i": "metadata/package/versioning::pe-originalfilename-field",
            "l": 2
          },
          {
            "c": 0.9399999976158142,
            "d": "PE overlay exceeds thirty-five percent",
            "e": [
              "binary.overlay_ratio = 0.65"
            ],
            "i": "metadata/binary/layout::overlay-over-35pct",
            "l": 3
          },
          {
            "c": 0.949999988079071,
            "d": "PE ProductName field is populated",
            "e": [
              "Microsoft® Windows® Operating System"
            ],
            "i": "metadata/package/versioning::pe-product-name-present",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.9900000095367432,
            "d": "PE version resource text",
            "e": [
              "VS_VERSION_INFO"
            ],
            "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.699999988079071,
            "d": "PE has few sections",
            "e": [
              "sections.count = 2.00"
            ],
            "i": "metadata/binary/layout::legacy-few-sections",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "ASLR enabled (DYNAMIC_BASE)",
            "e": [
              "[dynamic_base, nx_compat, no_seh]"
            ],
            "i": "metadata/hardening/mitigation::pe-aslr",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "PE first resource is RT_VERSION",
            "e": [
              "RT_VERSION"
            ],
            "i": "metadata/binary/resource::pe-resource-version-first",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "File is a compiled binary",
            "e": [
              "VirusShare_77504b0e01a79318fbcf6df6ea022d16"
            ],
            "i": "metadata/binary/framework::is-binary",
            "l": 1
          },
          {
            "c": 0.699999988079071,
            "d": "PE has many readable strings",
            "e": [
              "binary.string_count = 163.00"
            ],
            "i": "metadata/binary/layout::many-readable-strings",
            "l": 2
          },
          {
            "c": 0.8999999761581421,
            "d": "Microsoft vendor marker in resource section",
            "e": [
              "Microsoft Corporation"
            ],
            "i": "metadata/binary/vendor::microsoft-corp-marker-rsrc",
            "l": 1
          },
          {
            "a": "T1036.001",
            "c": 0.8399999737739563,
            "d": "Symantec timestamp string in overlay",
            "e": [
              "+Symantec Time Stamping Services Signer - G40"
            ],
            "i": "objectives/evasion/masquerade/binary::overlay-symantec-string",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "DEP / NX enabled (NX_COMPAT)",
            "e": [
              "[dynamic_base, nx_compat, no_seh]"
            ],
            "i": "metadata/hardening/mitigation::pe-dep",
            "l": 2
          },
          {
            "c": 0.8999999761581421,
            "d": "Regex component marker",
            "e": [
              "binary.overlay_ratio = 0.65"
            ],
            "i": "objectives/anti-static/obfuscation/control-flow/logic::bloated-low-density-malware-cond-5--inline-32080",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "Regex component marker",
            "e": [
              "CompareStringEx",
              "api-ms-win-core-string-l1-1-0.pdb",
              "CompareStringW",
              "kernel32.CompareStringEx",
              "kernel32.CompareStringOrdinal",
              "GetStringTypeW",
              "api-ms-win-core-string-l1-1-0.dll",
              "GetStringTypeExW",
              "StringFileInfo",
              "CompareStringOrdinal",
              "kernel32.CompareStringW",
              "kernel32.GetStringTypeW",
              "FoldStringW",
              "kernel32.GetStringTypeExW",
              "kernel32.FoldStringW"
            ],
            "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7",
            "l": 1
          },
          {
            "c": 0.699999988079071,
            "d": "PE ProductName metadata field",
            "e": [
              "ProductName"
            ],
            "i": "metadata/package/versioning::pe-productname-field",
            "l": 2
          },
          {
            "a": "T1036.005",
            "c": 0.949999988079071,
            "d": "Microsoft company version identity",
            "e": [
              "Microsoft Corporation"
            ],
            "i": "objectives/evasion/masquerade/version-resource/contradiction::microsoft-company-versioninfo-kv",
            "l": 1
          },
          {
            "c": 0.949999988079071,
            "d": "PE LegalCopyright field is populated",
            "e": [
              "© Microsoft Corporation. All rights reserved."
            ],
            "i": "metadata/package/versioning::pe-legal-copyright-present",
            "l": 1
          },
          {
            "c": 0.699999988079071,
            "d": "PE FileDescription metadata field",
            "e": [
              "FileDescription"
            ],
            "i": "metadata/package/versioning::pe-filedescription-field",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "NO_SEH (SafeSEH not used)",
            "e": [
              "[dynamic_base, nx_compat, no_seh]"
            ],
            "i": "metadata/hardening/mitigation::pe-no-seh",
            "l": 2
          },
          {
            "c": 0.8500000238418579,
            "d": "Get Unicode character type",
            "e": [
              "GetStringTypeW"
            ],
            "i": "micro-behaviors/os/env/access::get-string-type-w",
            "l": 2
          },
          {
            "a": "T1036.005",
            "c": 0.9700000286102295,
            "d": "Windows operating system product string",
            "e": [
              "Microsoft® Windows® Operating System"
            ],
            "i": "objectives/evasion/masquerade/version-resource/claim::getmac-product-string",
            "l": 1
          },
          {
            "c": 0.6000000238418579,
            "d": "Very few sections (merged/stripped)",
            "e": [
              "sections.count = 2.00"
            ],
            "i": "metadata/binary/metrics/structural::few-sections",
            "l": 3
          },
          {
            "c": 0.9200000166893005,
            "d": "Overlay exceeds one-third",
            "e": [
              "binary.overlay_ratio = 0.65"
            ],
            "i": "metadata/binary/layout::overlay-dominates-third",
            "l": 3
          },
          {
            "c": 0.8999999761581421,
            "d": "Tiny C string section ratio",
            "e": [
              " = 0.0% of total (0 / 8888 bytes)"
            ],
            "i": "metadata/binary/section/metrics::tiny-cstring-section",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.800000011920929,
            "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)",
            "e": [
              "pe.resource_count = 1.00"
            ],
            "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources",
            "l": 1
          },
          {
            "a": "T1055",
            "c": 0.949999988079071,
            "d": "Huge null run in executable (128+ bytes)",
            "e": [
              "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00"
            ],
            "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "Claims Microsoft Corp in version resource",
            "e": [
              "Microsoft Corporation",
              "Microsoft Corporation."
            ],
            "i": "metadata/binary/vendor::microsoft-corp-versioninfo",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.8600000143051147,
            "d": "Long mixed-case identifiers cluster",
            "e": [
              "WideCharToMultiByte",
              "MultiByteToWideChar"
            ],
            "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers",
            "l": 1,
            "m": "B0032"
          }
        ],
        "sha": "bf9cb0b75a8e89674ff41d16ca22a0e5193a37c1344367ff42611607fb46db1c",
        "path": "VirusShare_77504b0e01a79318fbcf6df6ea022d16",
        "type": "pe"
      }
    ],
    "tv": "a7886"
  }
}