{
  "ml": {
    "v": "5",
    "fs": [
      {
        "id": 0,
        "prob": 0.8251519203186035,
        "class": 0,
        "threshold": 0.9987763166427612
      }
    ],
    "prob": 0.8251519,
    "class": 0,
    "level": 3,
    "models": [
      {
        "m": "az",
        "prob": 0.8251519,
        "class": 0
      },
      {
        "m": "az/native",
        "prob": 0.21782178,
        "class": 0
      },
      {
        "m": "az/pe",
        "prob": 0.000115273775,
        "class": 0
      }
    ],
    "version": "v17.17",
    "threshold": 0.9987763,
    "analyzed_at": "2026-05-31T04:46:35Z"
  },
  "path": "c32790654f9a590f3340475ffd635ec2b908d04be6bf1d9efe35791501724b37.dll",
  "raw": {
    "v": "5",
    "fs": [
      {
        "f": "Md₂(BiSi)",
        "x": 5,
        "ff": {
          "i": [
            [
              "mscoree",
              "CorDllMain"
            ]
          ],
          "m": {
            "pe": {
              "checksum": 62661.0,
              "checksum_valid": 1.0,
              "resource_count": 1.0,
              "has_version_info": 1.0,
              "computed_checksum": 62661.0,
              "bss_like_section_count": 0.0,
              "section_overflow_count": 0.0,
              "misaligned_section_count": 0.0,
              "base_relocation_block_count": 1.0,
              "base_relocation_entry_count": 1.0
            },
            "file": {
              "size": 20256.0,
              "entropy": 6.61,
              "size_bytes": 20256.0
            },
            "binary": {
              "is_pie": 1.0,
              "has_overlay": 1.0,
              "code_entropy": 5.17,
              "overlay_size": 11552.0,
              "string_count": 364.0,
              "overlay_ratio": 0.57,
              "overlay_entropy": 7.36,
              "entropy_variance": 4.33,
              "avg_string_length": 18.51,
              "max_string_length": 145.0,
              "code_to_data_ratio": 1.0,
              "string_length_stddev": 16.99,
              "largest_section_ratio": 0.33,
              "sentence_string_count": 72.0,
              "sentence_string_ratio": 0.2,
              "high_entropy_string_count": 0.0
            },
            "imports": {
              "count": 1.0
            },
            "sections": {
              "count": 3.0,
              "code_size": 6656.0,
              "entropy_max": 5.17,
              "entropy_mean": 2.72,
              "name_entropy": 3.03,
              "writable_count": 0.0,
              "executable_count": 1.0,
              "nonstandard_count": 0.0,
              "executable_writable_count": 0.0
            },
            "dependencies": {
              "count": 1.0
            }
          },
          "s": [
            [
              77,
              "u8",
              "!This program cannot be run in DOS mode."
            ],
            [
              376,
              "u8",
              ".text"
            ],
            [
              455,
              "u8",
              "@.reloc"
            ],
            [
              608,
              "u8",
              "lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.R"
            ],
            [
              765,
              "u8",
              "PADPADPP)6"
            ],
            [
              1222,
              "wide",
              "BTN_CLOSE"
            ],
            [
              1272,
              "wide",
              "BTN_NO."
            ],
            [
              1314,
              "wide",
              "BTN_START_INSTALL\u003e"
            ],
            [
              1386,
              "wide",
              "BTN_YESr"
            ],
            [
              1444,
              "wide",
              "INSTALL_EULA_TXT´"
            ],
            [
              1528,
              "wide",
              "TXT_BROWSER_HPą"
            ],
            [
              1598,
              "wide",
              "TXT_CANCEL_SCREEN_DIALOGź"
            ],
            [
              1682,
              "wide",
              "TXT_CONFIG_BELOWǤ"
            ],
            [
              1752,
              "wide",
              "TXT_ERROR_INSTALL"
            ],
            [
              1822,
              "wide",
              "TXT_GET_WEBEXP"
            ],
            [
              1888,
              "wide",
              "TXT_INSTALL_AGREE"
            ],
            [
              1968,
              "wide",
              "TXT_INSTALL_COMPLETEϟ"
            ],
            [
              2056,
              "wide",
              "TXT_INSTALL_SUCCESSЗ"
            ],
            [
              2184,
              "wide",
              "TXT_MSG_3"
            ],
            [
              2230,
              "wide",
              "TXT_MS_DESCRIPTION"
            ],
            [
              2300,
              "wide",
              "TXT_NO_PROTECT"
            ],
            [
              2374,
              "wide",
              "TXT_READ_WC"
            ],
            [
              2434,
              "wide",
              "TXT_RESTORE_OPTION"
            ],
            [
              2508,
              "wide",
              "TXT_SET_HP"
            ],
            [
              2564,
              "wide",
              "TXT_SET_SE"
            ],
            [
              2612,
              "wide",
              "TXT_SORRY_TO_GO"
            ],
            [
              2696,
              "wide",
              "TXT_UNINSTALL_OPTION"
            ],
            [
              2788,
              "wide",
              "TXT_VALUE_PRIVACY"
            ],
            [
              2864,
              "wide",
              "TXT_WC_PROTECTS"
            ],
            [
              2933,
              "u8",
              "Non, gardez ma protection"
            ],
            [
              2960,
              "u8",
              "Fermer"
            ],
            [
              2967,
              "u8",
              "Installer"
            ],
            [
              2983,
              "u8",
              "Supprimer"
            ],
            [
              2998,
              "u8",
              "marrer l'installation"
            ],
            [
              3021,
              "u8",
              "Oui, je prends le risque"
            ],
            [
              3051,
              "u8",
              ";En installant ou en utilisant ce produit, vous acceptez son"
            ],
            [
              3113,
              "u8",
              "CLUF"
            ],
            [
              3119,
              "u8",
              "activer la fonction de barre de recherche Search Companion sur le bureau."
            ],
            [
              3194,
              "u8",
              "Page d'accueil du navigateur"
            ],
            [
              3224,
              "u8",
              "* Ad-Aware Web Companion va fermer votre navigateur pour appliquer les modifications."
            ],
            [
              3313,
              "u8",
              "tes-vous s"
            ],
            [
              3325,
              "u8",
              "r de vouloir annuler ?"
            ],
            [
              3348,
              "u8",
              "BVeuillez fermer le programme et essayer de l'installer"
            ],
            [
              3406,
              "u8",
              "nouveau."
            ],
            [
              3418,
              "u8",
              "Web Companion vous aide"
            ],
            [
              3444,
              "u8",
              "configurer votre page d'accueil de navigateur et votre moteur de recherche favoris. S"
            ],
            [
              3532,
              "u8",
              "lectionnez votre page d'accueil et votre moteur de recherche favoris ci-dessous."
            ],
            [
              3614,
              "u8",
              "Moteur de recherche par d"
            ],
            [
              3641,
              "u8",
              "faut"
            ],
            [
              3647,
              "u8",
              "Erreur d'installation"
            ],
            [
              3669,
              "u8",
              "=Web Companion a rencontr"
            ],
            [
              3696,
              "u8",
              "une erreur pendant l'installation."
            ],
            [
              3732,
              "u8",
              "4Profitez d'une exp"
            ],
            [
              3753,
              "u8",
              "rience Web plus s"
            ],
            [
              3772,
              "u8",
              "re et rapide."
            ],
            [
              3787,
              "u8",
              "guide d'assistance"
            ],
            [
              3867,
              "u8",
              "6L'installation de votre Web Companion a"
            ],
            [
              3913,
              "u8",
              "annul"
            ],
            [
              3924,
              "u8",
              "Installation termin"
            ],
            [
              3948,
              "u8",
              "Installation d"
            ],
            [
              3979,
              "u8",
              "-Web Companion a"
            ],
            [
              4001,
              "u8",
              "install"
            ],
            [
              4011,
              "u8",
              "avec succ"
            ],
            [
              4026,
              "u8",
              "*Contrat de licence de l'utilisateur final."
            ],
            [
              4070,
              "u8",
              "HSites Web essayant de transmettre des logiciels malveillants"
            ],
            [
              4134,
              "u8",
              "votre PC"
            ],
            [
              4144,
              "u8",
              "CFraudes d'hame"
            ],
            [
              4161,
              "u8",
              "onnage cherchant"
            ],
            [
              4180,
              "u8",
              "voler vos donn"
            ],
            [
              4197,
              "u8",
              "es personnelles"
            ],
            [
              4213,
              "u8",
              "$Traceurs suivant tous vos mouvements"
            ],
            [
              4251,
              "u8",
              "DSites malveillants se glissant dans les r"
            ],
            [
              4295,
              "u8",
              "sultats de vos recherches"
            ],
            [
              4321,
              "u8",
              "bVous"
            ],
            [
              4329,
              "u8",
              "tes sur le point de d"
            ],
            [
              4352,
              "u8",
              "sinstaller Adaware Web Companion, rendant votre PC vuln"
            ],
            [
              4409,
              "u8",
              "rable aux :"
            ],
            [
              4436,
              "u8",
              "r de vouloir d"
            ],
            [
              4452,
              "u8",
              "sinstaller?"
            ],
            [
              4474,
              "u8",
              "tes d"
            ],
            [
              4481,
              "u8",
              "sormais plus prot"
            ],
            [
              4503,
              "u8",
              "par la Protection Web de Web Companion."
            ],
            [
              4545,
              "u8",
              "Politique de confidentialit"
            ],
            [
              4576,
              "u8",
              "BSi vous avez besoin d'aide avec Web Companion, veuillez lire notre"
            ],
            [
              4644,
              "u8",
              "=Restaurer les param"
            ],
            [
              4666,
              "u8",
              "tres de page d'accueil de mon navigateur"
            ],
            [
              4709,
              "u8",
              "Si vous souhaitez restaurer vos valeurs de page d'accueil et de moteur de recherche"
            ],
            [
              4795,
              "u8",
              "celles en place avant l'installation de Web Companion, veuillez laisser les cases coch"
            ],
            [
              4888,
              "u8",
              "BRestaurer les param"
            ],
            [
              4910,
              "u8",
              "tres de moteur de recherche de mon navigateur"
            ],
            [
              4956,
              "u8",
              "AChoisissez la page qui s'ouvre au d"
            ],
            [
              4994,
              "u8",
              "marrage de votre navigateur."
            ],
            [
              5023,
              "u8",
              "?Choisissez votre page d'accueil et votre navigateur pr"
            ],
            [
              5089,
              "u8",
              "Choisissez quel moteur de recherche utiliser quand vous faites une recherche dans votre navigateur."
            ],
            [
              5189,
              "u8",
              "9Nous sommes sinc"
            ],
            [
              5208,
              "u8",
              "rement d"
            ],
            [
              5223,
              "u8",
              "s pour le d"
            ],
            [
              5248,
              "u8",
              "(Nous sommes navr"
            ],
            [
              5267,
              "u8",
              "s de vous voir partir."
            ],
            [
              5294,
              "u8",
              "sinstallation termin"
            ],
            [
              5318,
              "u8",
              "wNous esp"
            ],
            [
              5329,
              "u8",
              "rons que vous avez appr"
            ],
            [
              5358,
              "u8",
              "Web Companion. Veuillez choisir une des options de d"
            ],
            [
              5413,
              "u8",
              "sinstallation ci-dessous."
            ],
            [
              5439,
              "u8",
              "1Web Companion a"
            ],
            [
              5465,
              "u8",
              "sinstall"
            ],
            [
              5490,
              "u8",
              "hNotre respectons votre confidentialit"
            ],
            [
              5530,
              "u8",
              "et souhaitons que vous en appreniez davantage"
            ],
            [
              5579,
              "u8",
              "propos de notre"
            ],
            [
              5596,
              "u8",
              "YVous"
            ],
            [
              5611,
              "u8",
              "sormais prot"
            ],
            [
              5628,
              "u8",
              "contre les sites Web malveillants et les liens dangereux."
            ],
            [
              5687,
              "u8",
              "^Ad-Aware Web Companion vous prot"
            ],
            [
              5722,
              "u8",
              "ge contre les sites Web malveillants et les liens dangereux."
            ],
            [
              5783,
              "u8",
              "%Bienvenue dans Ad-Aware Web Companion"
            ],
            [
              5824,
              "u8",
              "BSJB"
            ],
            [
              6197,
              "u8",
              "\u003cModule\u003e"
            ],
            [
              6206,
              "u8",
              "mscorlib"
            ],
            [
              6215,
              "u8",
              "System.Reflection"
            ],
            [
              6233,
              "u8",
              "AssemblyTitleAttribute"
            ],
            [
              6256,
              "u8",
              ".ctor"
            ],
            [
              6262,
              "u8",
              "AssemblyDescriptionAttribute"
            ],
            [
              6291,
              "u8",
              "AssemblyCompanyAttribute"
            ],
            [
              6316,
              "u8",
              "AssemblyProductAttribute"
            ],
            [
              6341,
              "u8",
              "AssemblyCopyrightAttribute"
            ],
            [
              6368,
              "u8",
              "AssemblyTrademarkAttribute"
            ],
            [
              6395,
              "u8",
              "AssemblyFileVersionAttribute"
            ],
            [
              6424,
              "u8",
              "WebCompanionInstaller.resources.dll"
            ],
            [
              6460,
              "u8",
              "WebCompanionInstaller.resources"
            ],
            [
              6498,
              "u8",
              "WebCompanionInstaller.Localization.Resource.fr-CA.resources"
            ],
            [
              6624,
              "u8",
              "WebCompanionInstaller"
            ],
            [
              6657,
              "u8",
              "Copyright"
            ],
            [
              6669,
              "u8",
              "2015"
            ],
            [
              6766,
              "u8",
              "mscoree.dll"
            ],
            [
              7262,
              "wide",
              "VS_VERSION_INFO"
            ],
            [
              7354,
              "wide",
              "VarFileInfo"
            ],
            [
              7386,
              "wide",
              "Translation"
            ],
            [
              7422,
              "wide",
              "StringFileInfo"
            ],
            [
              7482,
              "wide",
              "FileDescription"
            ],
            [
              7516,
              "wide",
              "WebCompanionInstaller"
            ],
            [
              7566,
              "wide",
              "FileVersion"
            ],
            [
              7614,
              "wide",
              "InternalName"
            ],
            [
              7640,
              "wide",
              "WebCompanionInstaller.resources.dll"
            ],
            [
              7718,
              "wide",
              "LegalCopyright"
            ],
            [
              7748,
              "wide",
              "Copyright ©  2015"
            ],
            [
              7790,
              "wide",
              "OriginalFilename"
            ],
            [
              7902,
              "wide",
              "ProductName"
            ],
            [
              7978,
              "wide",
              "ProductVersion"
            ],
            [
              8030,
              "wide",
              "Assembly Version"
            ],
            [
              8906,
              "u8",
              "Western Cape1"
            ],
            [
              8929,
              "u8",
              "Durbanville1"
            ],
            [
              8951,
              "u8",
              "Thawte1"
            ],
            [
              8968,
              "u8",
              "Thawte Certification1"
            ],
            [
              8999,
              "u8",
              "Thawte Timestamping CA0"
            ],
            [
              9079,
              "u8",
              "Symantec Corporation100."
            ],
            [
              9109,
              "u8",
              "'Symantec Time Stamping Services CA - G20"
            ],
            [
              9510,
              "u8",
              "http://ocsp.thawte.com0"
            ],
            [
              9560,
              "u8",
              "80604"
            ],
            [
              9570,
              "u8",
              ".http://crl.thawte.com/ThawteTimestampingCA.crl0"
            ],
            [
              9680,
              "u8",
              "TimeStamp-2048-10"
            ],
            [
              10004,
              "u8",
              "201229235959Z0b1"
            ],
            [
              10043,
              "u8",
              "Symantec Corporation1402"
            ],
            [
              10073,
              "u8",
              "+Symantec Time Stamping Services Signer - G40"
            ],
            [
              10503,
              "u8",
              "http://ts-ocsp.ws.symantec.com07"
            ],
            [
              10546,
              "u8",
              "+http://ts-aia.ws.symantec.com/tss-ca-g2.cer0\u003c"
            ],
            [
              10598,
              "u8",
              "50301"
            ],
            [
              10608,
              "u8",
              "+http://ts-crl.ws.symantec.com/tss-ca-g2.crl0("
            ],
            [
              10678,
              "u8",
              "TimeStamp-2048-20"
            ],
            [
              10787,
              "u8",
              "b07x"
            ],
            [
              11106,
              "u8",
              "Symantec Corporation1"
            ],
            [
              11137,
              "u8",
              "Symantec Trust Network100."
            ],
            [
              11169,
              "u8",
              "'Symantec Class 3 SHA256 Code Signing CA0"
            ],
            [
              11228,
              "u8",
              "190329235959Z0e1"
            ],
            [
              11267,
              "u8",
              "Sliema1"
            ],
            [
              11301,
              "u8",
              "Lavasoft Limited1"
            ],
            [
              11328,
              "u8",
              "Lavasoft Limited0"
            ],
            [
              11552,
              "u8",
              "0yiYT1"
            ],
            [
              11692,
              "u8",
              "http://sv.symcb.com/sv.crl0a"
            ],
            [
              11726,
              "u8",
              "Z0X0V"
            ],
            [
              11755,
              "u8",
              "https://d.symcb.com/cps0%"
            ],
            [
              11794,
              "u8",
              "https://d.symcb.com/rpa0"
            ],
            [
              11851,
              "u8",
              "K0I0"
            ],
            [
              11868,
              "u8",
              "http://sv.symcd.com0\u0026"
            ],
            [
              11901,
              "u8",
              "http://sv.symcb.com/sv.crt0"
            ],
            [
              12340,
              "u8",
              "VeriSign, Inc.1"
            ],
            [
              12365,
              "u8",
              "VeriSign Trust Network1:08"
            ],
            [
              12397,
              "u8",
              "1(c) 2006 VeriSign, Inc. - For authorized use only1E0C"
            ],
            [
              12457,
              "u8",
              "\u003cVeriSign Class 3 Public Primary Certification Authority - G50"
            ],
            [
              12537,
              "u8",
              "231209235959Z0"
            ],
            [
              13011,
              "u8",
              "http://s2.symcb.com0"
            ],
            [
              13058,
              "u8",
              "e0c0a"
            ],
            [
              13092,
              "u8",
              "http://www.symauth.com/cps0("
            ],
            [
              13134,
              "u8",
              "http://www.symauth.com/rpa00"
            ],
            [
              13179,
              "u8",
              "http://s1.symcb.com/pca3-g5.crl0"
            ],
            [
              13283,
              "u8",
              "SymantecPKI-1-5670"
            ],
            [
              13361,
              "u8",
              "3130"
            ],
            [
              13743,
              "u8",
              "'Symantec Class 3 SHA256 Code Signing CA"
            ],
            [
              14289,
              "u8",
              "'Symantec Time Stamping Services CA - G2"
            ],
            [
              14806,
              "u8",
              "N0L0"
            ],
            [
              18275,
              "u8",
              "20190317051328Z"
            ],
            [
              18323,
              "u8",
              "Greater Manchester1"
            ],
            [
              18352,
              "u8",
              "Salford1"
            ],
            [
              18370,
              "u8",
              "COMODO CA Limited1,0*"
            ],
            [
              18397,
              "u8",
              "#COMODO SHA-256 Time Stamping Signer"
            ],
            [
              18523,
              "u8",
              "Salt Lake City1"
            ],
            [
              18548,
              "u8",
              "The USERTRUST Network1!0"
            ],
            [
              18580,
              "u8",
              "http://www.usertrust.com1"
            ],
            [
              18615,
              "u8",
              "UTN-USERFirst-Object0"
            ],
            [
              18639,
              "u8",
              "151231000000Z"
            ],
            [
              18654,
              "u8",
              "190709184036Z0"
            ],
            [
              18768,
              "u8",
              "#COMODO SHA-256 Time Stamping Signer0"
            ],
            [
              19240,
              "u8",
              "1http://crl.usertrust.com/UTN-USERFirst-Object.crl05"
            ],
            [
              19320,
              "u8",
              "http://ocsp.usertrust.com0"
            ],
            [
              19767,
              "u8",
              "UTN-USERFirst-Object"
            ],
            [
              19868,
              "u8",
              "190317051328Z0+"
            ]
          ],
          "v": {
            "file.stem": "c32790654f9a590f3340475ffd635ec2b908d04be6bf1d9efe35791501724b37",
            "pe.imphash": "dae02f32a21e03ce65412f6e56942daa",
            "pe.machine": "i386",
            "pe.subsystem": "windows_cui",
            "pe.timestamp": 1552799405,
            "file.basename": "c32790654f9a590f3340475ffd635ec2b908d04be6bf1d9efe35791501724b37.dll",
            "pe.image_base": 4194304,
            "pe.image_size": 32768,
            "pe.machine_id": 332,
            "pe.os_version": "4.0",
            "pe.version.os": "unknown",
            "pe.entry_point": 14462,
            "pe.headers_size": 512,
            "pe.version.type": "dll",
            "pe.entry_section": ".text",
            "pe.subsystem_raw": 3,
            "pe.clr.is_il_only": 1,
            "pe.file_alignment": 512,
            "pe.cert_table_size": 11552,
            "pe.image_hash.sha1": "269f9c4694480818811816b09b6501f8744f013c",
            "pe.image_hash.sha256": "7ec36ef6b80acc7e5d98fcb81160d3e6345fd866dd628a4a02f03e19f949310e",
            "pe.image_hash.sha384": "b98a0190bd6e3220e2978a6b4ef5f445cbf11222fcbfd0988218e1dea8af500ed6601c8b4890e10b2c06cd50322cf8c5",
            "pe.image_hash.sha512": "235461d53cc57559528ae80f120f2e11f94ec7e0dcd0e788dda49a629e623ffe4b3b4e533ea4a02bc2cf4232987c2cdb564917f7685f663584ad74b1c35d6353",
            "pe.resource_types[0]": "RT_VERSION",
            "pe.section_alignment": 8192,
            "pe.subsystem_version": "4.0",
            "pe.version.copyright": "Copyright ©  2015",
            "pe.characteristics[0]": "executable_image",
            "pe.characteristics[1]": "32bit_machine",
            "pe.characteristics[2]": "dll",
            "pe.characteristics_raw": 8450,
            "pe.clr.runtime_version": "2.5",
            "pe.version.description": "WebCompanionInstaller",
            "pe.linker_major_version": 8,
            "pe.signatures[0].issuer": "CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US",
            "pe.signatures[0].serial": "76ee7ef043821e76143e9510553389e1",
            "pe.version.file_version": "1.0.0.0",
            "pe.version.product_name": "WebCompanionInstaller",
            "pe.signatures[0].subject": "CN=Lavasoft Limited,O=Lavasoft Limited,L=Sliema,ST=Sliema,C=MT",
            "pe.version.internal_name": "WebCompanionInstaller.resources.dll",
            "pe.dll_characteristics[0]": "dynamic_base",
            "pe.dll_characteristics[1]": "nx_compat",
            "pe.dll_characteristics[2]": "no_seh",
            "pe.dll_characteristics[3]": "terminal_server_aware",
            "pe.signatures[0].verified": true,
            "pe.data_directories[0].rva": 14372,
            "pe.data_directories[1].rva": 16384,
            "pe.data_directories[2].rva": 8704,
            "pe.data_directories[3].rva": 24576,
            "pe.data_directories[4].rva": 8192,
            "pe.data_directories[5].rva": 8200,
            "pe.dll_characteristics_raw": 34112,
            "pe.number_of_rva_and_sizes": 16,
            "pe.signatures[0].not_after": "2019-03-29T23:59:59Z",
            "pe.version.product_version": "1.0.0.0",
            "pe.data_directories[0].name": "import",
            "pe.data_directories[0].size": 87,
            "pe.data_directories[1].name": "resource",
            "pe.data_directories[1].size": 912,
            "pe.data_directories[2].name": "certificate",
            "pe.data_directories[2].size": 11552,
            "pe.data_directories[3].name": "base_relocation",
            "pe.data_directories[3].size": 12,
            "pe.data_directories[4].name": "iat",
            "pe.data_directories[4].size": 8,
            "pe.data_directories[5].name": "clr_runtime_header",
            "pe.data_directories[5].size": 72,
            "pe.signatures[0].not_before": "2017-03-13T00:00:00Z",
            "pe.version.original_filename": "WebCompanionInstaller.resources.dll",
            "pe.coff.dos_header_pe_pointer": 128,
            "pe.signatures[0].nested.issuer": "CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US",
            "pe.signatures[0].nested.serial": "76ee7ef043821e76143e9510553389e1",
            "pe.base_relocations.block_count": 1,
            "pe.base_relocations.entry_count": 1,
            "pe.signatures[0].nested.subject": "CN=Lavasoft Limited,O=Lavasoft Limited,L=Sliema,ST=Sliema,C=MT",
            "pe.signatures[0].nested.verified": true,
            "pe.signatures[0].thumbprint_sha1": "b99c6f735653238eb611e1dab57eeb588d0fc8d4",
            "pe.base_relocations.padding_count": 1,
            "pe.signatures[0].cert_chain_depth": 4,
            "pe.signatures[0].digest_algorithm": "sha1",
            "pe.signatures[0].eku_code_signing": true,
            "pe.signatures[0].nested.not_after": "2019-03-29T23:59:59Z",
            "pe.signatures[0].signature_digest": "269f9c4694480818811816b09b6501f8744f013c",
            "pe.signatures[0].nested.not_before": "2017-03-13T00:00:00Z",
            "pe.signatures[0].thumbprint_sha256": "da69984bbcd8b1874771dad74ea324069e82f7e7825d4eaa6716365bba957550",
            "pe.signatures[0].signature_algorithm": "sha256WithRSAEncryption",
            "pe.signatures[0].nested.thumbprint_sha1": "b99c6f735653238eb611e1dab57eeb588d0fc8d4",
            "pe.signatures[0].nested.cert_chain_depth": 2,
            "pe.signatures[0].nested.digest_algorithm": "sha256",
            "pe.signatures[0].nested.eku_code_signing": true,
            "pe.signatures[0].nested.signature_digest": "7ec36ef6b80acc7e5d98fcb81160d3e6345fd866dd628a4a02f03e19f949310e",
            "pe.signatures[0].nested.thumbprint_sha256": "da69984bbcd8b1874771dad74ea324069e82f7e7825d4eaa6716365bba957550",
            "pe.signatures[0].nested.signature_algorithm": "sha256WithRSAEncryption",
            "pe.signatures[0].signature_digest_algorithm": "sha1",
            "pe.signatures[0].nested.signature_digest_algorithm": "sha256"
          },
          "id": "pe",
          "sc": [
            [
              ".text",
              512,
              6656,
              5.17,
              "r-x"
            ],
            [
              ".rsrc",
              7168,
              1024,
              2.9,
              "r--"
            ],
            [
              ".reloc",
              8192,
              512,
              0.08,
              "r--"
            ]
          ]
        },
        "id": 0,
        "sz": 20256,
        "ts": [
          {
            "c": 1.0,
            "d": ".NET assembly detected via BSJB CLR metadata signature",
            "e": [
              "BSJB at offset 0x16c0"
            ],
            "i": "metadata/dotnet/bsjb-signature",
            "l": 2,
            "el": [
              "0x16c0"
            ]
          },
          {
            "c": 1.0,
            "d": "Authenticode chain CN: Lavasoft Limited",
            "e": [
              "Lavasoft Limited"
            ],
            "i": "metadata/signed/unknown::lavasoft-limited",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "Signed by Lavasoft Limited",
            "e": [
              "Lavasoft Limited"
            ],
            "i": "metadata/signed/leaf::lavasoft-limited",
            "l": 3
          },
          {
            "c": 1.0,
            "d": "File is a compiled binary",
            "e": [
              "c32790654f9a590f3340475ffd635ec2b908d04be6bf1d9efe35791501724b37.dll"
            ],
            "i": "metadata/binary/framework::is-binary",
            "l": 1
          },
          {
            "c": 0.949999988079071,
            "d": "PE LegalCopyright field is populated",
            "e": [
              "Copyright ©  2015"
            ],
            "i": "metadata/package/versioning::pe-legal-copyright-present",
            "l": 1,
            "el": [
              "value:pe.version.copyright"
            ]
          },
          {
            "c": 0.699999988079071,
            "d": "Reflection method namespace token",
            "e": [
              "System.Reflection"
            ],
            "i": "objectives/anti-static/obfuscation/reflection/invoke::namespace-import",
            "l": 1,
            "el": [
              "0x1847"
            ]
          },
          {
            "c": 1.0,
            "d": ".NET Metadata Root (BSJB)",
            "e": [
              "BSJB"
            ],
            "i": "metadata/binary/framework::dotnet-metadata",
            "l": 2
          },
          {
            "c": 0.949999988079071,
            "d": "PE FileDescription field is populated",
            "e": [
              "WebCompanionInstaller"
            ],
            "i": "metadata/package/versioning::pe-file-description-present",
            "l": 1,
            "el": [
              "value:pe.version.description"
            ]
          },
          {
            "c": 0.6000000238418579,
            "d": "Copyright notice",
            "e": [
              "Copyright"
            ],
            "i": "metadata/package/license::copyright-word",
            "l": 2,
            "el": [
              "0x1a01"
            ]
          },
          {
            "c": 0.9200000166893005,
            "d": "PE FileVersion resembles IPv4",
            "e": [
              "1.0.0.0"
            ],
            "i": "metadata/package/versioning::pe-file-version-ipv4-shape",
            "l": 1,
            "el": [
              "value:pe.version.file_version"
            ]
          },
          {
            "d": ".dll extension reference",
            "e": [
              ".dll"
            ],
            "i": "micro-behaviors/fs/path/extension::dll-dup",
            "l": 2,
            "el": [
              "0x1918"
            ]
          },
          {
            "c": 0.699999988079071,
            "d": "PE has few sections",
            "e": [
              "sections.count = 3.00"
            ],
            "i": "metadata/binary/layout::legacy-few-sections",
            "l": 2
          },
          {
            "c": 0.949999988079071,
            "d": "PE ProductName field is populated",
            "e": [
              "WebCompanionInstaller"
            ],
            "i": "metadata/package/versioning::pe-product-name-present",
            "l": 1,
            "el": [
              "value:pe.version.product_name"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "mscorlib reference",
            "e": [
              "lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.R",
              "mscorlib"
            ],
            "i": "metadata/lang/compiler/managed::mscorlib",
            "l": 2,
            "el": [
              "0x260",
              "0x183e"
            ]
          },
          {
            "c": 1.0,
            "d": "PE first resource is RT_VERSION",
            "e": [
              "RT_VERSION"
            ],
            "i": "metadata/binary/resource::pe-resource-version-first",
            "l": 2,
            "el": [
              "value:pe.resource_types[0]"
            ]
          },
          {
            "a": "T1027",
            "c": 0.9900000095367432,
            "d": "PE version resource text",
            "e": [
              "VS_VERSION_INFO"
            ],
            "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info",
            "l": 1,
            "m": "B0032",
            "el": [
              "0x1c5e"
            ]
          },
          {
            "a": "T1036.001",
            "c": 0.8399999737739563,
            "d": "Symantec timestamp string in overlay",
            "e": [
              "+Symantec Time Stamping Services Signer - G40"
            ],
            "i": "objectives/evasion/masquerade/binary::overlay-symantec-string",
            "l": 1,
            "el": [
              "0x2759"
            ]
          },
          {
            "c": 0.699999988079071,
            "d": "PE has many readable strings",
            "e": [
              "binary.string_count = 364.00"
            ],
            "i": "metadata/binary/layout::many-readable-strings",
            "l": 2
          },
          {
            "c": 0.8999999761581421,
            "d": "PE standard code/data section",
            "e": [
              ".text"
            ],
            "i": "metadata/binary/section/names::pe-code-data-standard-section",
            "l": 1
          },
          {
            "c": 0.699999988079071,
            "d": "PE import table has exactly one entry",
            "e": [
              "imports.count = 1.00"
            ],
            "i": "metadata/binary/symbols/imports::single-import-raw",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Binary has 4 or fewer sections",
            "e": [
              "sections.count = 3.00"
            ],
            "i": "objectives/command-and-control/infrastructure/config::max-sections-4",
            "l": 1
          },
          {
            "c": 0.9200000166893005,
            "d": "PE ProductVersion resembles IPv4",
            "e": [
              "1.0.0.0"
            ],
            "i": "metadata/package/versioning::pe-product-version-ipv4-shape",
            "l": 1,
            "el": [
              "value:pe.version.product_version"
            ]
          },
          {
            "c": 0.800000011920929,
            "d": "CompanyName field absent from PE version info",
            "e": [
              "field 'pe.version.company' does not exist"
            ],
            "i": "metadata/binary/anomaly/format::version-info-company-name-absent",
            "l": 1,
            "el": [
              "value:pe.version.company"
            ]
          },
          {
            "c": 0.8500000238418579,
            "d": "DLL filename extension present",
            "e": [
              "c32790654f9a590f3340475ffd635ec2b908d04be6bf1d9efe35791501724b37.dll"
            ],
            "i": "objectives/evasion/masquerade/dll/name::dll-basename",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "NO_SEH (SafeSEH not used)",
            "e": [
              "[dynamic_base, nx_compat, no_seh, terminal_server_aware]"
            ],
            "i": "metadata/hardening/mitigation::pe-no-seh",
            "l": 2,
            "el": [
              "value:pe.dll_characteristics"
            ]
          },
          {
            "a": "T1036.001",
            "c": 0.8600000143051147,
            "d": "USERTrust certificate string in overlay",
            "e": [
              "The USERTRUST Network1!0"
            ],
            "i": "objectives/evasion/masquerade/binary::overlay-usertrust-string",
            "l": 1,
            "el": [
              "0x4874"
            ]
          },
          {
            "c": 0.699999988079071,
            "d": "PE InternalName metadata field",
            "e": [
              "InternalName"
            ],
            "i": "metadata/package/versioning::pe-internalname-field",
            "l": 2,
            "el": [
              "0x1dbe"
            ]
          },
          {
            "c": 0.949999988079071,
            "d": "PE version info numeric fields present",
            "e": [
              "1.0.0.0"
            ],
            "i": "metadata/binary/anomaly/format::version-info-file-version-present",
            "l": 1,
            "el": [
              "value:pe.version.file_version"
            ]
          },
          {
            "c": 1.0,
            "d": "PE Authenticode signature verified metadata",
            "e": [
              "true"
            ],
            "i": "metadata/signed/certificate::pe-signature-verified-kv",
            "l": 2,
            "el": [
              "value:pe.signatures[0].verified"
            ]
          },
          {
            "a": "T1620",
            "c": 0.949999988079071,
            "d": "mscoree DLL string reference",
            "e": [
              "mscoree.dll"
            ],
            "i": "objectives/anti-static/obfuscation/payload/loader::mscoree-name-anywhere",
            "l": 1,
            "m": "B0032",
            "el": [
              "0x1a6e"
            ]
          },
          {
            "c": 0.699999988079071,
            "d": "PE OriginalFilename metadata field",
            "e": [
              "OriginalFilename"
            ],
            "i": "metadata/package/versioning::pe-originalfilename-field",
            "l": 2,
            "el": [
              "0x1e6e"
            ]
          },
          {
            "a": "T1036.001",
            "c": 0.8799999952316284,
            "d": "UTN USERFirst Object string in overlay",
            "e": [
              "UTN-USERFirst-Object",
              "UTN-USERFirst-Object0",
              "1http://crl.usertrust.com/UTN-USERFirst-Object.crl05"
            ],
            "i": "objectives/evasion/masquerade/binary::overlay-utn-object-string",
            "l": 1,
            "el": [
              "0x4d37",
              "0x48b7",
              "0x4b28"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "SOCKS5 client greeting bytes",
            "e": [
              "05 01 00"
            ],
            "i": "micro-behaviors/communications/proxy/socks::socks5-version-greeting-bytes",
            "l": 1,
            "el": [
              "0x614"
            ]
          },
          {
            "a": "T1036.001",
            "c": 0.8600000143051147,
            "d": "COMODO certificate string in overlay",
            "e": [
              "COMODO CA Limited1,0*"
            ],
            "i": "objectives/evasion/masquerade/binary::overlay-comodo-string",
            "l": 1,
            "el": [
              "0x47c2"
            ]
          },
          {
            "c": 1.0,
            "d": "PE binary has trailing overlay data",
            "e": [
              "binary.has_overlay = 1.00"
            ],
            "i": "metadata/binary/layout::has-overlay",
            "l": 3
          },
          {
            "a": "T1562.001",
            "c": 0.949999988079071,
            "d": "Regex component marker",
            "e": [
              "TXT_VALUE_PRIVACY"
            ],
            "i": "objectives/evasion/indicator-removal/cleanup::motw-removal-stream--rx-3",
            "l": 1,
            "m": "B0047",
            "el": [
              "0xae4"
            ]
          },
          {
            "c": 1.0,
            "d": "DEP / NX enabled (NX_COMPAT)",
            "e": [
              "[dynamic_base, nx_compat, no_seh, terminal_server_aware]"
            ],
            "i": "metadata/hardening/mitigation::pe-dep",
            "l": 2,
            "el": [
              "value:pe.dll_characteristics"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "PE .reloc section presence",
            "e": [
              ".reloc"
            ],
            "i": "metadata/binary/section/names::reloc-section-presence",
            "l": 2
          },
          {
            "a": "T1027.009",
            "c": 0.8600000143051147,
            "d": ".NET ResourceReader payload access",
            "e": [
              "lSystem.Resources.ResourceReader, mscorlib, Version=2.0.…"
            ],
            "i": "micro-behaviors/data/embedded/payload/resource::dotnet-resource-reader",
            "l": 1,
            "el": [
              "0x260"
            ]
          },
          {
            "c": 1.0,
            "d": "ASLR enabled (DYNAMIC_BASE)",
            "e": [
              "[dynamic_base, nx_compat, no_seh, terminal_server_aware]"
            ],
            "i": "metadata/hardening/mitigation::pe-aslr",
            "l": 2,
            "el": [
              "value:pe.dll_characteristics"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "Regex component marker",
            "e": [
              "binary.overlay_ratio = 0.57"
            ],
            "i": "objectives/anti-static/obfuscation/control-flow/logic::bloated-low-density-malware-cond-5--inline-32080",
            "l": 1
          },
          {
            "c": 0.699999988079071,
            "d": "PE ProductName metadata field",
            "e": [
              "ProductName"
            ],
            "i": "metadata/package/versioning::pe-productname-field",
            "l": 2,
            "el": [
              "0x1ede"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "PE resource section",
            "e": [
              ".rsrc"
            ],
            "i": "metadata/binary/section/names::pe-resource-section",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "PE standard runtime section",
            "e": [
              ".reloc"
            ],
            "i": "metadata/binary/section/names::pe-runtime-standard-section",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "Regex component marker",
            "e": [
              "StringFileInfo"
            ],
            "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7",
            "l": 1,
            "el": [
              "0x1cfe"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "PE has under ten imports",
            "e": [
              "imports.count = 1.00"
            ],
            "i": "objectives/anti-static/pack/runtime::pe-import-count-under-10",
            "l": 1
          },
          {
            "c": 0.699999988079071,
            "d": "PE with six or fewer imports",
            "e": [
              "imports.count = 1.00"
            ],
            "i": "metadata/binary/symbols/imports::pe-imports-max-six",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "PE checksum matches computed value",
            "e": [
              "pe.checksum_valid = 1.00"
            ],
            "i": "metadata/binary/layout::pe-checksum-valid",
            "l": 1
          },
          {
            "c": 0.9399999976158142,
            "d": "PE overlay exceeds thirty-five percent",
            "e": [
              "binary.overlay_ratio = 0.57"
            ],
            "i": "metadata/binary/layout::overlay-over-35pct",
            "l": 3
          },
          {
            "c": 0.8500000238418579,
            "d": "IPv4-like .NET assembly version",
            "e": [
              "Version=2.0.0.0"
            ],
            "i": "metadata/lang/compiler/managed::dotnet-ipv4-like-version",
            "l": 2,
            "el": [
              "0x260"
            ]
          },
          {
            "c": 0.699999988079071,
            "d": "PE FileDescription metadata field",
            "e": [
              "FileDescription"
            ],
            "i": "metadata/package/versioning::pe-filedescription-field",
            "l": 2,
            "el": [
              "0x1d3a"
            ]
          },
          {
            "a": "T1027",
            "c": 0.8399999737739563,
            "d": "VB6 PE with three sections",
            "e": [
              "sections.count = 3.00"
            ],
            "i": "objectives/anti-static/obfuscation/payload/string-sparse::three-section-vb6-layout",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.800000011920929,
            "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)",
            "e": [
              "pe.resource_count = 1.00"
            ],
            "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources",
            "l": 1
          },
          {
            "a": "T1105",
            "c": 0.800000011920929,
            "d": "Compact PE import table",
            "e": [
              "imports.count = 1.00"
            ],
            "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table",
            "l": 1,
            "m": "E1105"
          },
          {
            "c": 1.0,
            "d": ".NET BSJB metadata marker",
            "e": [
              "BSJB"
            ],
            "i": "metadata/binary/framework::bsjb-marker",
            "l": 1
          },
          {
            "a": "T1055",
            "c": 0.9200000166893005,
            "d": "Regex component marker",
            "e": [
              "imports.count = 1.00"
            ],
            "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571",
            "l": 1,
            "m": "C0041"
          },
          {
            "c": 0.9200000166893005,
            "d": "Overlay exceeds one-third",
            "e": [
              "binary.overlay_ratio = 0.57"
            ],
            "i": "metadata/binary/layout::overlay-dominates-third",
            "l": 3
          },
          {
            "c": 0.800000011920929,
            "d": "Tiny resource section (no version/icon)",
            "e": [
              ".rsrc (size: 1024)"
            ],
            "i": "metadata/binary/resource::minimal-resources",
            "l": 2
          },
          {
            "a": "T1027",
            "c": 0.8600000143051147,
            "d": "Long mixed-case identifiers cluster",
            "e": [
              "WebCompanionInstaller",
              "AssemblyDescriptionAttribute",
              "AssemblyCopyrightAttribute",
              "AssemblyFileVersionAttribute",
              "AssemblyTitleAttribute",
              "AssemblyCompanyAttribute",
              "AssemblyTrademarkAttribute",
              "AssemblyProductAttribute"
            ],
            "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers",
            "l": 1,
            "m": "B0032",
            "el": [
              "0x1918",
              "0x1876",
              "0x18c5",
              "0x18fb",
              "0x1859",
              "0x1893",
              "0x18e0",
              "0x18ac"
            ]
          },
          {
            "c": 0.949999988079071,
            "d": "links mscoree (CorDllMain)",
            "e": [
              "mscoree"
            ],
            "i": "metadata/dylib::mscoree",
            "l": 2,
            "el": [
              "1 symbols"
            ]
          },
          {
            "a": "T1036.005",
            "c": 0.9399999976158142,
            "d": "Two dotted-quad version strings",
            "e": [
              "1.0.0.0"
            ],
            "i": "objectives/evasion/masquerade/identity/fabricated::dotted-quad-version-pair",
            "l": 1,
            "el": [
              "value:pe.version.file_version"
            ]
          },
          {
            "c": 0.949999988079071,
            "d": "PE version numbers look like IPv4",
            "e": [
              "1.0.0.0"
            ],
            "i": "metadata/package/versioning::version-number-ipv4-metadata",
            "l": 1,
            "el": [
              "value:pe.version.file_version"
            ]
          }
        ],
        "sha": "c32790654f9a590f3340475ffd635ec2b908d04be6bf1d9efe35791501724b37",
        "path": "c32790654f9a590f3340475ffd635ec2b908d04be6bf1d9efe35791501724b37.dll",
        "type": "pe"
      }
    ],
    "tv": "52045"
  }
}