{
  "ml": {
    "v": "5",
    "fs": [
      {
        "id": 0,
        "prob": 0.8251519203186035,
        "class": 0,
        "threshold": 0.9987763166427612
      }
    ],
    "prob": 0.8251519,
    "class": 0,
    "level": 3,
    "models": [
      {
        "m": "az",
        "prob": 0.8251519,
        "class": 0
      },
      {
        "m": "az/native",
        "prob": 0.27968338,
        "class": 0
      },
      {
        "m": "az/pe",
        "prob": 0.014666666,
        "class": 0
      }
    ],
    "version": "v17.17",
    "threshold": 0.9987763,
    "analyzed_at": "2026-05-30T17:29:59Z"
  },
  "path": "c765be5e14f6ce6d171159c02234c09b4f1faa7292cdd7dc4f824eb35b77a24b.exe",
  "raw": {
    "v": "5",
    "fs": [
      {
        "f": "Md₂(BiSi)",
        "x": 5,
        "ff": {
          "i": [
            [
              "mscoree",
              "CorExeMain"
            ]
          ],
          "m": {
            "pe": {
              "checksum": 325751.0,
              "icon_count": 2.0,
              "checksum_valid": 1.0,
              "resource_count": 4.0,
              "has_version_info": 1.0,
              "computed_checksum": 325751.0,
              "bss_like_section_count": 0.0,
              "section_overflow_count": 0.0,
              "misaligned_section_count": 0.0,
              "base_relocation_block_count": 1.0,
              "base_relocation_entry_count": 1.0
            },
            "file": {
              "size": 306320.0,
              "entropy": 5.76,
              "size_bytes": 306320.0
            },
            "binary": {
              "is_pie": 1.0,
              "has_overlay": 1.0,
              "code_entropy": 5.43,
              "overlay_size": 5264.0,
              "string_count": 1030.0,
              "overlay_ratio": 0.02,
              "overlay_entropy": 7.27,
              "entropy_variance": 6.15,
              "avg_string_length": 61.77,
              "max_string_length": 13892.0,
              "code_to_data_ratio": 1.0,
              "string_length_stddev": 500.63,
              "largest_section_ratio": 0.54,
              "sentence_string_count": 10.0,
              "sentence_string_ratio": 0.01,
              "high_entropy_string_count": 0.0
            },
            "imports": {
              "count": 1.0
            },
            "sections": {
              "count": 3.0,
              "code_size": 133120.0,
              "entropy_max": 5.43,
              "entropy_mean": 3.61,
              "name_entropy": 3.03,
              "writable_count": 0.0,
              "executable_count": 1.0,
              "nonstandard_count": 0.0,
              "executable_writable_count": 0.0
            },
            "dependencies": {
              "count": 1.0
            }
          },
          "s": [
            [
              77,
              "u8",
              "!This program cannot be run in DOS mode."
            ],
            [
              376,
              "u8",
              ".text"
            ],
            [
              455,
              "u8",
              "@.reloc"
            ],
            [
              83008,
              "u8",
              "BSJB"
            ],
            [
              84788,
              "u8",
              "UInt32"
            ],
            [
              84795,
              "u8",
              "ToInt32"
            ],
            [
              84803,
              "u8",
              "ISetupInstance2"
            ],
            [
              84819,
              "u8",
              "ISetupConfiguration2"
            ],
            [
              84840,
              "u8",
              "\u003cModule\u003e"
            ],
            [
              84849,
              "u8",
              "LoadLibraryA"
            ],
            [
              84862,
              "u8",
              "GetTypeFromCLSID"
            ],
            [
              84879,
              "u8",
              "System.IO"
            ],
            [
              84889,
              "u8",
              "ProjectData"
            ],
            [
              84901,
              "u8",
              "mscorlib"
            ],
            [
              84910,
              "u8",
              "System.Collections.Generic"
            ],
            [
              84937,
              "u8",
              "Microsoft.VisualBasic"
            ],
            [
              84963,
              "u8",
              "Versioned"
            ],
            [
              84973,
              "u8",
              "Guid"
            ],
            [
              84978,
              "u8",
              "ReadToEnd"
            ],
            [
              84988,
              "u8",
              "Round"
            ],
            [
              84994,
              "u8",
              "set_Method"
            ],
            [
              85005,
              "u8",
              "CompareMethod"
            ],
            [
              85019,
              "u8",
              "Replace"
            ],
            [
              85027,
              "u8",
              "CreateInstance"
            ],
            [
              85042,
              "u8",
              "ISetupInstance"
            ],
            [
              85057,
              "u8",
              "MakeINode"
            ],
            [
              85067,
              "u8",
              "ToDouble"
            ],
            [
              85076,
              "u8",
              "File"
            ],
            [
              85081,
              "u8",
              "get_MainModule"
            ],
            [
              85096,
              "u8",
              "ProcessModule"
            ],
            [
              85110,
              "u8",
              "NameStyle"
            ],
            [
              85120,
              "u8",
              "AppWinStyle"
            ],
            [
              85132,
              "u8",
              "set_Name"
            ],
            [
              85141,
              "u8",
              "get_AccessibleName"
            ],
            [
              85160,
              "u8",
              "set_AccessibleName"
            ],
            [
              85179,
              "u8",
              "get_FileName"
            ],
            [
              85192,
              "u8",
              "GetName"
            ],
            [
              85200,
              "u8",
              "CallByName"
            ],
            [
              85211,
              "u8",
              "Combine"
            ],
            [
              85219,
              "u8",
              "Microsoft.VisualStudio.ExtensionEngine"
            ],
            [
              85258,
              "u8",
              "PhoenixAnalysisEngine"
            ],
            [
              85280,
              "u8",
              "CallType"
            ],
            [
              85289,
              "u8",
              "SecurityProtocolType"
            ],
            [
              85310,
              "u8",
              "GetType"
            ],
            [
              85318,
              "u8",
              "WebResponse"
            ],
            [
              85330,
              "u8",
              "Create"
            ],
            [
              85337,
              "u8",
              "ComVisibleAttribute"
            ],
            [
              85357,
              "u8",
              "AssemblyTitleAttribute"
            ],
            [
              85380,
              "u8",
              "AssemblyTrademarkAttribute"
            ],
            [
              85407,
              "u8",
              "TargetFrameworkAttribute"
            ],
            [
              85432,
              "u8",
              "AssemblyFileVersionAttribute"
            ],
            [
              85461,
              "u8",
              "AssemblyDescriptionAttribute"
            ],
            [
              85490,
              "u8",
              "CompilationRelaxationsAttribute"
            ],
            [
              85522,
              "u8",
              "AssemblyProductAttribute"
            ],
            [
              85547,
              "u8",
              "AssemblyCopyrightAttribute"
            ],
            [
              85574,
              "u8",
              "AssemblyCompanyAttribute"
            ],
            [
              85599,
              "u8",
              "WriteByte"
            ],
            [
              85609,
              "u8",
              "ToByte"
            ],
            [
              85656,
              "u8",
              ".exe"
            ],
            [
              85661,
              "u8",
              "NewLateBinding"
            ],
            [
              85676,
              "u8",
              "System.Runtime.Versioning"
            ],
            [
              85702,
              "u8",
              "ToString"
            ],
            [
              85711,
              "u8",
              "Math"
            ],
            [
              85716,
              "u8",
              "GetEnginePath"
            ],
            [
              85730,
              "u8",
              "GetInstallationPath"
            ],
            [
              85750,
              "u8",
              "GetInstanceForPath"
            ],
            [
              85769,
              "u8",
              "ContainsPath"
            ],
            [
              85782,
              "u8",
              "get_Length"
            ],
            [
              85793,
              "u8",
              "StartsWith"
            ],
            [
              85808,
              "u8",
              "Marshal"
            ],
            [
              85816,
              "u8",
              "Decimal"
            ],
            [
              85824,
              "u8",
              "Panel"
            ],
            [
              85830,
              "u8",
              "kernel32.dll"
            ],
            [
              85843,
              "u8",
              "Shell"
            ],
            [
              85849,
              "u8",
              "EventSymbol"
            ],
            [
              85861,
              "u8",
              "set_SecurityProtocol"
            ],
            [
              85882,
              "u8",
              "Control"
            ],
            [
              85890,
              "u8",
              "MemoryStream"
            ],
            [
              85903,
              "u8",
              "System"
            ],
            [
              85910,
              "u8",
              "Conversion"
            ],
            [
              85921,
              "u8",
              "Microsoft.VisualStudio.Setup.Configuration"
            ],
            [
              85964,
              "u8",
              "SetupConfiguration"
            ],
            [
              85983,
              "u8",
              "Microsoft.VisualStudio.ExtensionManager.Implementation"
            ],
            [
              86038,
              "u8",
              "Interaction"
            ],
            [
              86050,
              "u8",
              "System.Reflection"
            ],
            [
              86068,
              "u8",
              "Exception"
            ],
            [
              86078,
              "u8",
              "Button"
            ],
            [
              86085,
              "u8",
              "StreamReader"
            ],
            [
              86098,
              "u8",
              "NameProvider"
            ],
            [
              86111,
              "u8",
              "Microsoft.VisualStudio.ExtensionManager"
            ],
            [
              86151,
              "u8",
              "ServicePointManager"
            ],
            [
              86171,
              "u8",
              "CreateProjectError"
            ],
            [
              86190,
              "u8",
              "ClearProjectError"
            ],
            [
              86208,
              "u8",
              "SetProjectError"
            ],
            [
              86224,
              "u8",
              "Activator"
            ],
            [
              86234,
              "u8",
              ".ctor"
            ],
            [
              86240,
              "u8",
              ".cctor"
            ],
            [
              86247,
              "u8",
              "UIntPtr"
            ],
            [
              86255,
              "u8",
              "System.Diagnostics"
            ],
            [
              86274,
              "u8",
              "System.Runtime.InteropServices"
            ],
            [
              86305,
              "u8",
              "Microsoft.VisualBasic.CompilerServices"
            ],
            [
              86344,
              "u8",
              "System.Runtime.CompilerServices"
            ],
            [
              86376,
              "u8",
              "Microsoft.FxCop.Sdk.INodes"
            ],
            [
              86403,
              "u8",
              "EngineUtilities"
            ],
            [
              86419,
              "u8",
              "Strings"
            ],
            [
              86427,
              "u8",
              "Microsoft.VisualStudio.CodeAnalysis"
            ],
            [
              86463,
              "u8",
              "Phx.Symbols"
            ],
            [
              86475,
              "u8",
              "System.Windows.Forms"
            ],
            [
              86496,
              "u8",
              "Contains"
            ],
            [
              86505,
              "u8",
              "Conversions"
            ],
            [
              86517,
              "u8",
              "StringSplitOptions"
            ],
            [
              86536,
              "u8",
              "Microsoft.FxCop.Sdk.NameProviders"
            ],
            [
              86570,
              "u8",
              "Microsoft.FxCop.Engines.Phoenix.INodeWrappers"
            ],
            [
              86616,
              "u8",
              "GetCurrentProcess"
            ],
            [
              86634,
              "u8",
              "GetProcAddress"
            ],
            [
              86649,
              "u8",
              "Exists"
            ],
            [
              86656,
              "u8",
              "Concat"
            ],
            [
              86663,
              "u8",
              "Format"
            ],
            [
              86670,
              "u8",
              "ExtensibleObject"
            ],
            [
              86687,
              "u8",
              "VirtualProtect"
            ],
            [
              86702,
              "u8",
              "LateGet"
            ],
            [
              86710,
              "u8",
              "System.Net"
            ],
            [
              86721,
              "u8",
              "op_Explicit"
            ],
            [
              86733,
              "u8",
              "Split"
            ],
            [
              86739,
              "u8",
              "Convert"
            ],
            [
              86747,
              "u8",
              "WebRequest"
            ],
            [
              86758,
              "u8",
              "set_Timeout"
            ],
            [
              86778,
              "u8",
              "Microsoft.FxCop.Engines.Phoenix"
            ],
            [
              86810,
              "u8",
              "Microsoft.VisualStudio.CodeAnalysis.Phoenix"
            ],
            [
              86854,
              "u8",
              "RichTextBox"
            ],
            [
              86866,
              "u8",
              "ToArray"
            ],
            [
              86874,
              "u8",
              "Copy"
            ],
            [
              86879,
              "u8",
              "PhxWrapperFactory"
            ],
            [
              86897,
              "u8",
              "IsNullOrEmpty"
            ],
            [
              122060,
              "u8",
              "epg\tTpg\u003eTpg\tTpg"
            ],
            [
              132418,
              "u8",
              "RSA1"
            ],
            [
              132567,
              "u8",
              ".NETFramework,Version=v4.0"
            ],
            [
              132598,
              "u8",
              "FrameworkDisplayName"
            ],
            [
              132619,
              "u8",
              ".NET Framework 4.5"
            ],
            [
              132693,
              "u8",
              ". All rights reserved."
            ],
            [
              133374,
              "u8",
              "mscoree.dll"
            ],
            [
              134234,
              "wide",
              "PROFILE_DATA"
            ],
            [
              135456,
              "u8",
              "Q46568"
            ],
            [
              137189,
              "u8",
              "System.Threading.Tasks"
            ],
            [
              137252,
              "u8",
              "System.IO.Pipes"
            ],
            [
              137283,
              "u8",
              "System.Collections.Immutable"
            ],
            [
              137316,
              "u8",
              "Validation"
            ],
            [
              137366,
              "u8",
              "AsyncTaskMethodBuilder`1"
            ],
            [
              137398,
              "u8",
              "ConfiguredTaskAwaitable`1"
            ],
            [
              137431,
              "u8",
              "ConfiguredTaskAwaiter"
            ],
            [
              137460,
              "u8",
              "NamedPipeServerStream"
            ],
            [
              137489,
              "u8",
              "Task"
            ],
            [
              137516,
              "u8",
              "ICollection`1"
            ],
            [
              137537,
              "u8",
              "IEnumerable`1"
            ],
            [
              137558,
              "u8",
              "Enumerator"
            ],
            [
              137576,
              "u8",
              "IReadOnlyList`1"
            ],
            [
              137599,
              "u8",
              "IReadOnlyCollection`1"
            ],
            [
              137627,
              "u8",
              "IEquatable`1"
            ],
            [
              137648,
              "u8",
              "ImmutableArray`1"
            ],
            [
              137672,
              "u8",
              "IImmutableList`1"
            ],
            [
              137696,
              "u8",
              "Builder"
            ],
            [
              137711,
              "u8",
              "ImmutableArray"
            ],
            [
              137733,
              "u8",
              "AsyncTaskMethodBuilder"
            ],
            [
              137763,
              "u8",
              "VoidTaskResult"
            ],
            [
              137785,
              "u8",
              "ConfiguredTaskAwaitable"
            ],
            [
              137845,
              "u8",
              "IEnumerator`1"
            ],
            [
              137865,
              "u8",
              "Requires"
            ],
            [
              137882,
              "u8",
              "ImmutableExtensions"
            ],
            [
              137909,
              "u8",
              "\u003cGetEnumerator\u003ed__1"
            ],
            [
              138215,
              "u8",
              "Start"
            ],
            [
              138227,
              "u8",
              "AwaitUnsafeOnCompleted"
            ],
            [
              138255,
              "u8",
              "op_Equality"
            ],
            [
              138274,
              "u8",
              "op_Inequality"
            ],
            [
              138316,
              "u8",
              "ToImmutableArray"
            ],
            [
              138350,
              "u8",
              "get_Task"
            ],
            [
              138366,
              "u8",
              "UnsafeOnCompleted"
            ],
            [
              138390,
              "u8",
              "EnsureCapacity"
            ],
            [
              138410,
              "u8",
              "CreateRange"
            ],
            [
              138429,
              "u8",
              "NotNull"
            ],
            [
              138441,
              "u8",
              "TryGetCount"
            ],
            [
              138486,
              "u8",
              "get_Count"
            ],
            [
              138503,
              "u8",
              "8System.Collections.Generic.IEnumerable\u003cT\u003e.GetEnumerator"
            ],
            [
              138565,
              "u8",
              "MoveNext"
            ],
            [
              138580,
              "u8",
              "get_Item"
            ],
            [
              138595,
              "u8",
              "6System.Collections.Generic.IEnumerator\u003cT\u003e.get_Current"
            ],
            [
              138656,
              "u8",
              "System.IDisposable.Dispose"
            ],
            [
              138689,
              "u8",
              "GetEnumerator"
            ],
            [
              138709,
              "u8",
              "SetResult"
            ],
            [
              138727,
              "u8",
              "TrySetResult"
            ],
            [
              140151,
              "u8",
              "IHDR"
            ],
            [
              140177,
              "u8",
              "IDATx"
            ],
            [
              142404,
              "u8",
              "/455"
            ],
            [
              142422,
              "u8",
              "XEQO"
            ],
            [
              143899,
              "u8",
              "Sbni"
            ],
            [
              144502,
              "u8",
              "E9AU"
            ],
            [
              147479,
              "u8",
              "xiHGo"
            ],
            [
              148381,
              "u8",
              "IDAT"
            ],
            [
              148894,
              "u8",
              "CIJuaUX"
            ],
            [
              151009,
              "u8",
              "AkTDkT"
            ],
            [
              151625,
              "u8",
              "808T"
            ],
            [
              152357,
              "u8",
              "/EspZ"
            ],
            [
              152474,
              "u8",
              "FYu J"
            ],
            [
              156268,
              "u8",
              "LWNX"
            ],
            [
              156388,
              "u8",
              "KNmBG"
            ],
            [
              156928,
              "u8",
              "FlAQu"
            ],
            [
              160465,
              "u8",
              "IEND"
            ],
            [
              299546,
              "wide",
              "VS_VERSION_INFO"
            ],
            [
              299638,
              "wide",
              "StringFileInfo"
            ],
            [
              299674,
              "wide",
              "040904b0"
            ],
            [
              299698,
              "wide",
              "Comments"
            ],
            [
              299738,
              "wide",
              "CompanyName"
            ],
            [
              299778,
              "wide",
              "FileDescription"
            ],
            [
              299834,
              "wide",
              "FileVersion"
            ],
            [
              299882,
              "wide",
              "LegalCopyright"
            ],
            [
              299922,
              "wide",
              ". All rights reserved."
            ],
            [
              299974,
              "wide",
              "OriginalFilename"
            ],
            [
              300022,
              "wide",
              ".exe"
            ],
            [
              300038,
              "wide",
              "ProductName"
            ],
            [
              300086,
              "wide",
              "ProductVersion"
            ],
            [
              300138,
              "wide",
              "Assembly Version"
            ],
            [
              300194,
              "wide",
              "LegalTrademarks"
            ],
            [
              300242,
              "wide",
              "VarFileInfo"
            ],
            [
              300274,
              "wide",
              "Translation"
            ],
            [
              300304,
              "u8",
              "PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDING"
            ],
            [
              301122,
              "u8",
              "N0L0"
            ],
            [
              301408,
              "u8",
              "Guangzhou1"
            ],
            [
              301435,
              "u8",
              "201012043152Z"
            ],
            [
              301450,
              "u8",
              "211012043152Z0"
            ],
            [
              301805,
              "u8",
              "C0A0"
            ],
            [
              302703,
              "u8",
              "20201012043153Z"
            ],
            [
              302794,
              "u8",
              "DigiCert Inc1"
            ],
            [
              302817,
              "u8",
              "www.digicert.com110/"
            ],
            [
              302843,
              "u8",
              "(DigiCert SHA2 Assured ID Timestamping CA0"
            ],
            [
              302903,
              "u8",
              "301017000000Z0L1"
            ],
            [
              302942,
              "u8",
              "DigiCert, Inc.1$0\""
            ],
            [
              302967,
              "u8",
              "TIMESTAMP-SHA256-2019-10-150"
            ],
            [
              303400,
              "u8",
              "https://www.digicert.com/CPS0"
            ],
            [
              303873,
              "u8",
              "j0h02"
            ],
            [
              303883,
              "u8",
              ",http://crl3.digicert.com/sha2-assured-ts.crl02"
            ],
            [
              303935,
              "u8",
              ",http://crl4.digicert.com/sha2-assured-ts.crl0"
            ],
            [
              304011,
              "u8",
              "http://ocsp.digicert.com0O"
            ],
            [
              304048,
              "u8",
              "Chttp://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0"
            ],
            [
              304487,
              "u8",
              "www.digicert.com1$0\""
            ],
            [
              304514,
              "u8",
              "DigiCert Assured ID Root CA0"
            ],
            [
              304545,
              "u8",
              "160107120000Z"
            ],
            [
              304560,
              "u8",
              "310107120000Z0r1"
            ],
            [
              305142,
              "u8",
              "http://ocsp.digicert.com0C"
            ],
            [
              305179,
              "u8",
              "7http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0"
            ],
            [
              305254,
              "u8",
              "4http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:"
            ],
            [
              305314,
              "u8",
              "4http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P"
            ],
            [
              305375,
              "u8",
              "I0G08"
            ],
            [
              305814,
              "u8",
              "(DigiCert SHA2 Assured ID Timestamping CA"
            ],
            [
              305936,
              "u8",
              "201012043153Z0+"
            ]
          ],
          "v": {
            "file.stem": "c765be5e14f6ce6d171159c02234c09b4f1faa7292cdd7dc4f824eb35b77a24b",
            "pe.imphash": "f34d5f2d4577ed6d9ceec516c1f5a744",
            "pe.machine": "i386",
            "pe.subsystem": "windows_gui",
            "pe.timestamp": 2543240997,
            "file.basename": "c765be5e14f6ce6d171159c02234c09b4f1faa7292cdd7dc4f824eb35b77a24b.exe",
            "pe.image_base": 4194304,
            "pe.image_size": 327680,
            "pe.machine_id": 332,
            "pe.os_version": "4.0",
            "pe.version.os": "unknown",
            "pe.entry_point": 141070,
            "pe.headers_size": 512,
            "pe.version.type": "dll",
            "pe.entry_section": ".text",
            "pe.subsystem_raw": 2,
            "pe.clr.is_il_only": 1,
            "pe.file_alignment": 512,
            "pe.cert_table_size": 5264,
            "pe.image_hash.sha1": "5264f5c28cadfe725d3534eb8fd7ff7580288eb6",
            "pe.version.company": "艾丝艾",
            "pe.version.comments": "艾迪丝 比艾弗",
            "pe.image_hash.sha256": "4deda7433a9c7b18ba382766453009e64c81367a4537a8c281780a04529ac422",
            "pe.image_hash.sha384": "c2df0d6db5bb50443f5dfa6116ed6070177d740c2ffc782c0ab42cc8541865f1cda03f0f06e622cdd0001139c8325687",
            "pe.image_hash.sha512": "c05114247015adc089ce47ef82e05c9f310eb16658210f6a16f78ca8d7ed0cdbe1963af618eee31067e2bb38640f4c7bba86e455f4f834ed0d8177d4c141bdca",
            "pe.resource_types[0]": "RT_ICON",
            "pe.resource_types[1]": "RT_GROUP_ICON",
            "pe.resource_types[2]": "RT_VERSION",
            "pe.section_alignment": 8192,
            "pe.subsystem_version": "6.0",
            "pe.version.copyright": "© 弗艾比. All rights reserved.",
            "pe.characteristics[0]": "executable_image",
            "pe.characteristics[1]": "large_address_aware",
            "pe.version.trademarks": "迪比丝",
            "pe.characteristics_raw": 34,
            "pe.clr.runtime_version": "2.5",
            "pe.version.description": "丝比弗 艾迪迪",
            "pe.linker_major_version": 48,
            "pe.signatures[0].issuer": "C=CN,L=Guangzhou,OU=吾诶马诶伊吾诶吾,O=伊伊诶吾马马伊М伊М伊М吾马诶马伊诶诶屁伊,CN=М伊М诶屁吾马伊ММ",
            "pe.signatures[0].serial": "00b1d5fb1edf682bcc24f62956c69b9688",
            "pe.version.file_version": "3.0.2.7",
            "pe.version.product_name": "比贼迪 丝迪弗",
            "pe.signatures[0].subject": "C=CN,L=Guangzhou,OU=吾诶马诶伊吾诶吾,O=伊伊诶吾马马伊М伊М伊М吾马诶马伊诶诶屁伊,CN=М伊М诶屁吾马伊ММ",
            "pe.dll_characteristics[0]": "high_entropy_va",
            "pe.dll_characteristics[1]": "dynamic_base",
            "pe.dll_characteristics[2]": "nx_compat",
            "pe.dll_characteristics[3]": "no_seh",
            "pe.dll_characteristics[4]": "terminal_server_aware",
            "pe.signatures[0].verified": true,
            "pe.data_directories[0].rva": 140988,
            "pe.data_directories[1].rva": 147456,
            "pe.data_directories[2].rva": 301056,
            "pe.data_directories[3].rva": 319488,
            "pe.data_directories[4].rva": 8192,
            "pe.data_directories[5].rva": 8200,
            "pe.dll_characteristics_raw": 34144,
            "pe.number_of_rva_and_sizes": 16,
            "pe.signatures[0].not_after": "2021-10-12T04:31:52Z",
            "pe.version.product_version": "6.0.5.3",
            "pe.data_directories[0].name": "import",
            "pe.data_directories[0].size": 79,
            "pe.data_directories[1].name": "resource",
            "pe.data_directories[1].size": 166672,
            "pe.data_directories[2].name": "certificate",
            "pe.data_directories[2].size": 5264,
            "pe.data_directories[3].name": "base_relocation",
            "pe.data_directories[3].size": 12,
            "pe.data_directories[4].name": "iat",
            "pe.data_directories[4].size": 8,
            "pe.data_directories[5].name": "clr_runtime_header",
            "pe.data_directories[5].size": 72,
            "pe.signatures[0].not_before": "2020-10-12T04:31:52Z",
            "pe.signatures[0].self_issued": true,
            "pe.version.original_filename": "比贼迪 丝迪弗.exe",
            "pe.coff.dos_header_pe_pointer": 128,
            "pe.base_relocations.block_count": 1,
            "pe.base_relocations.entry_count": 1,
            "pe.signatures[0].thumbprint_sha1": "ded5693f24bc1ab57d053f6db1a3d4471977b6e6",
            "pe.base_relocations.padding_count": 1,
            "pe.signatures[0].cert_chain_depth": 1,
            "pe.signatures[0].digest_algorithm": "sha256",
            "pe.signatures[0].eku_code_signing": true,
            "pe.signatures[0].signature_digest": "4deda7433a9c7b18ba382766453009e64c81367a4537a8c281780a04529ac422",
            "pe.signatures[0].thumbprint_sha256": "644c4f2432543c71ed80a1fffb9319e9b2f0ad5d9fb5839b08441d13694ca3d8",
            "pe.signatures[0].signature_algorithm": "sha256WithRSAEncryption",
            "pe.signatures[0].signature_digest_algorithm": "sha256"
          },
          "id": "pe",
          "sc": [
            [
              ".text",
              512,
              133120,
              5.43,
              "r-x"
            ],
            [
              ".rsrc",
              133632,
              166912,
              5.29,
              "r--"
            ],
            [
              ".reloc",
              300544,
              512,
              0.1,
              "r--"
            ]
          ]
        },
        "id": 0,
        "sz": 306320,
        "ts": [
          {
            "c": 1.0,
            "d": ".NET assembly detected via BSJB CLR metadata signature",
            "e": [
              "BSJB at offset 0x14440"
            ],
            "i": "metadata/dotnet/bsjb-signature",
            "l": 2,
            "el": [
              "0x14440"
            ]
          },
          {
            "c": 1.0,
            "d": "Authenticode chain CN: М伊М诶屁吾马伊ММ",
            "e": [
              "М伊М诶屁吾马伊ММ"
            ],
            "i": "metadata/signed/unknown::м伊м诶屁吾马伊мм",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "Signed by 伊伊诶吾马马伊М伊М伊М吾马诶马伊诶诶屁伊",
            "e": [
              "伊伊诶吾马马伊М伊М伊М吾马诶马伊诶诶屁伊"
            ],
            "i": "metadata/signed/leaf::伊伊诶吾马马伊м伊м伊м吾马诶马伊诶诶屁伊",
            "l": 3
          },
          {
            "c": 1.0,
            "d": "PE checksum matches computed value",
            "e": [
              "pe.checksum_valid = 1.00"
            ],
            "i": "metadata/binary/layout::pe-checksum-valid",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Binary has 1000 or more strings",
            "e": [
              "binary.string_count = 1030.00"
            ],
            "i": "metadata/binary/metrics/threshold::string-count-1000-plus",
            "l": 2
          },
          {
            "c": 0.699999988079071,
            "d": "Reflection method namespace token",
            "e": [
              "System.Reflection"
            ],
            "i": "objectives/anti-static/obfuscation/reflection/invoke::namespace-import",
            "l": 1,
            "el": [
              "0x15022"
            ]
          },
          {
            "c": 0.8600000143051147,
            "d": "VB CallByName late binding",
            "e": [
              "43 61 6C 6C 42 79 4E 61 6D 65"
            ],
            "i": "objectives/anti-static/obfuscation/reflection/invoke::vb-callbyname-token",
            "l": 1,
            "el": [
              "0x14cd0"
            ]
          },
          {
            "c": 1.0,
            "d": "ASLR enabled (DYNAMIC_BASE)",
            "e": [
              "[high_entropy_va, dynamic_base, nx_compat, no_seh, terminal_server_aware]"
            ],
            "i": "metadata/hardening/mitigation::pe-aslr",
            "l": 2,
            "el": [
              "value:pe.dll_characteristics"
            ]
          },
          {
            "c": 0.699999988079071,
            "d": "PE FileDescription metadata field",
            "e": [
              "FileDescription"
            ],
            "i": "metadata/package/versioning::pe-filedescription-field",
            "l": 2,
            "el": [
              "0x49302"
            ]
          },
          {
            "c": 1.0,
            "d": "PE Authenticode signature verified metadata",
            "e": [
              "true"
            ],
            "i": "metadata/signed/certificate::pe-signature-verified-kv",
            "l": 2,
            "el": [
              "value:pe.signatures[0].verified"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "PE has under ten imports",
            "e": [
              "imports.count = 1.00"
            ],
            "i": "objectives/anti-static/pack/runtime::pe-import-count-under-10",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "PE has RT_ICON in resources list",
            "e": [
              "[RT_ICON, RT_GROUP_ICON, RT_VERSION]"
            ],
            "i": "metadata/binary/resource::pe-resource-icon-list",
            "l": 2,
            "el": [
              "value:pe.resource_types"
            ]
          },
          {
            "c": 0.949999988079071,
            "d": "PE version info numeric fields present",
            "e": [
              "3.0.2.7"
            ],
            "i": "metadata/binary/anomaly/format::version-info-file-version-present",
            "l": 1,
            "el": [
              "value:pe.version.file_version"
            ]
          },
          {
            "c": 0.699999988079071,
            "d": "PE import table has exactly one entry",
            "e": [
              "imports.count = 1.00"
            ],
            "i": "metadata/binary/symbols/imports::single-import-raw",
            "l": 1
          },
          {
            "c": 0.7200000286102295,
            "d": "Path combination helper token",
            "e": [
              "Combine"
            ],
            "i": "micro-behaviors/fs/temp/directory::path-combine-token",
            "l": 1,
            "el": [
              "0x14cdb"
            ]
          },
          {
            "c": 1.0,
            "d": "PE binary has trailing overlay data",
            "e": [
              "binary.has_overlay = 1.00"
            ],
            "i": "metadata/binary/layout::has-overlay",
            "l": 3
          },
          {
            "c": 1.0,
            "d": "NO_SEH (SafeSEH not used)",
            "e": [
              "[high_entropy_va, dynamic_base, nx_compat, no_seh, terminal_server_aware]"
            ],
            "i": "metadata/hardening/mitigation::pe-no-seh",
            "l": 2,
            "el": [
              "value:pe.dll_characteristics"
            ]
          },
          {
            "c": 0.9200000166893005,
            "d": "PE FileVersion resembles IPv4",
            "e": [
              "3.0.2.7"
            ],
            "i": "metadata/package/versioning::pe-file-version-ipv4-shape",
            "l": 1,
            "el": [
              "value:pe.version.file_version"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "PE .reloc section presence",
            "e": [
              ".reloc"
            ],
            "i": "metadata/binary/section/names::reloc-section-presence",
            "l": 2
          },
          {
            "c": 1.0,
            "d": ".NET Metadata Root (BSJB)",
            "e": [
              "BSJB"
            ],
            "i": "metadata/binary/framework::dotnet-metadata",
            "l": 2
          },
          {
            "a": "T1027",
            "c": 0.9900000095367432,
            "d": "PE version resource text",
            "e": [
              "VS_VERSION_INFO"
            ],
            "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info",
            "l": 1,
            "m": "B0032",
            "el": [
              "0x4921a"
            ]
          },
          {
            "c": 0.8500000238418579,
            "d": "Visual Basic runtime reference",
            "e": [
              "Microsoft.VisualBasic.CompilerServices",
              "Microsoft.VisualBasic"
            ],
            "i": "metadata/lang/compiler/managed::visual-basic-runtime",
            "l": 2,
            "el": [
              "0x15121",
              "0x14bc9"
            ]
          },
          {
            "a": "T1620",
            "c": 0.949999988079071,
            "d": "mscoree DLL string reference",
            "e": [
              "mscoree.dll"
            ],
            "i": "objectives/anti-static/obfuscation/payload/loader::mscoree-name-anywhere",
            "l": 1,
            "m": "B0032",
            "el": [
              "0x208fe"
            ]
          },
          {
            "a": "T1574.002",
            "c": 0.8999999761581421,
            "d": "Windows GetProcAddress API string",
            "e": [
              "GetProcAddress"
            ],
            "i": "micro-behaviors/dylib/lookup::get-proc-address-text",
            "l": 2,
            "el": [
              "0x1526a"
            ]
          },
          {
            "c": 0.949999988079071,
            "d": "PE FileDescription field is populated",
            "e": [
              "丝比弗 艾迪迪"
            ],
            "i": "metadata/package/versioning::pe-file-description-present",
            "l": 1,
            "el": [
              "value:pe.version.description"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "PE resource section",
            "e": [
              ".rsrc"
            ],
            "i": "metadata/binary/section/names::pe-resource-section",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "High-entropy ASLR (64-bit)",
            "e": [
              "[high_entropy_va, dynamic_base, nx_compat, no_seh, terminal_server_aware]"
            ],
            "i": "metadata/hardening/mitigation::pe-high-entropy-va",
            "l": 2,
            "el": [
              "value:pe.dll_characteristics"
            ]
          },
          {
            "c": 0.8399999737739563,
            "d": "PNG image data in PE resources",
            "e": [
              "IHDR"
            ],
            "i": "metadata/binary/resource::png-resource-marker",
            "l": 2,
            "el": [
              "0x22377"
            ]
          },
          {
            "c": 0.699999988079071,
            "d": "PE OriginalFilename metadata field",
            "e": [
              "OriginalFilename"
            ],
            "i": "metadata/package/versioning::pe-originalfilename-field",
            "l": 2,
            "el": [
              "0x493c6"
            ]
          },
          {
            "a": "T1614",
            "c": 0.6000000238418579,
            "d": "Country code ID token (repeated)",
            "e": [
              " ID "
            ],
            "i": "objectives/anti-analysis/geofencing/region/cluster::country-code-id",
            "l": 1,
            "m": "B0007.003",
            "el": [
              "0x49efb"
            ]
          },
          {
            "c": 0.800000011920929,
            "d": "Dynamic object instantiation via Activator",
            "e": [
              "Activator"
            ],
            "i": "objectives/anti-static/obfuscation/reflection/invoke::activator",
            "l": 1,
            "el": [
              "0x150d0"
            ]
          },
          {
            "c": 1.0,
            "d": "DEP / NX enabled (NX_COMPAT)",
            "e": [
              "[high_entropy_va, dynamic_base, nx_compat, no_seh, terminal_server_aware]"
            ],
            "i": "metadata/hardening/mitigation::pe-dep",
            "l": 2,
            "el": [
              "value:pe.dll_characteristics"
            ]
          },
          {
            "a": "T1140",
            "c": 0.9200000166893005,
            "d": "VB NewLateBinding dispatch helper",
            "e": [
              "NewLateBinding"
            ],
            "i": "objectives/command-and-control/dropper/staging/embedded::vb-newlatebinding",
            "l": 1,
            "m": "B0030",
            "el": [
              "0x14e9d"
            ]
          },
          {
            "a": "T1485",
            "c": 0.8999999761581421,
            "d": "Preserves .exe .gho .bak files",
            "e": [
              ".exe"
            ],
            "i": "objectives/impact/destroy/file-deletion::exe-gho-bak-whitelist",
            "l": 1,
            "m": "C0047",
            "el": [
              "0x14e98"
            ]
          },
          {
            "c": 0.800000011920929,
            "d": "System namespace reference",
            "e": [
              "System.Net",
              "System.IO"
            ],
            "i": "metadata/lang/compiler/managed::system-namespace",
            "l": 2,
            "el": [
              "0x152b6",
              "0x14b8f"
            ]
          },
          {
            "c": 0.699999988079071,
            "d": "PE CompanyName metadata field",
            "e": [
              "CompanyName"
            ],
            "i": "metadata/package/versioning::pe-companyname-field",
            "l": 2,
            "el": [
              "0x492da"
            ]
          },
          {
            "c": 0.800000011920929,
            "d": "Large PE resource section (\u003e150KB)",
            "e": [
              ".rsrc (size: 166912)"
            ],
            "i": "objectives/anti-static/obfuscation/binary-metrics/overlay::large-pe-resource-section",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "Windows Forms UI framework",
            "e": [
              "System.Windows.Forms"
            ],
            "i": "metadata/lang/compiler/managed::winforms-ui",
            "l": 2,
            "el": [
              "0x151cb"
            ]
          },
          {
            "c": 0.9200000166893005,
            "d": "PE ProductVersion resembles IPv4",
            "e": [
              "6.0.5.3"
            ],
            "i": "metadata/package/versioning::pe-product-version-ipv4-shape",
            "l": 1,
            "el": [
              "value:pe.version.product_version"
            ]
          },
          {
            "c": 1.0,
            "d": "Binary has 4 or fewer sections",
            "e": [
              "sections.count = 3.00"
            ],
            "i": "objectives/command-and-control/infrastructure/config::max-sections-4",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "File is a compiled binary",
            "e": [
              "c765be5e14f6ce6d171159c02234c09b4f1faa7292cdd7dc4f824eb35b77a24b.exe"
            ],
            "i": "metadata/binary/framework::is-binary",
            "l": 1
          },
          {
            "c": 0.699999988079071,
            "d": "PE has few sections",
            "e": [
              "sections.count = 3.00"
            ],
            "i": "metadata/binary/layout::legacy-few-sections",
            "l": 2
          },
          {
            "c": 0.75,
            "d": "Runtime interop services",
            "e": [
              "System.Runtime.InteropServices"
            ],
            "i": "metadata/lang/compiler/managed::runtime-interop",
            "l": 2,
            "el": [
              "0x15102"
            ]
          },
          {
            "c": 0.699999988079071,
            "d": "PE with six or fewer imports",
            "e": [
              "imports.count = 1.00"
            ],
            "i": "metadata/binary/symbols/imports::pe-imports-max-six",
            "l": 1
          },
          {
            "a": "T1140",
            "c": 0.8399999737739563,
            "d": "CreateInstance activation token",
            "e": [
              "CreateInstance"
            ],
            "i": "objectives/command-and-control/dropper/staging/embedded::createinstance-token",
            "l": 1,
            "m": "B0030",
            "el": [
              "0x14c23"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": ".NET WPF namespace reference",
            "e": [
              "System.Windows"
            ],
            "i": "well-known/game/mod::wpf-namespace-ref",
            "l": 1,
            "el": [
              "0x151cb"
            ]
          },
          {
            "d": ".dll extension reference",
            "e": [
              ".dll"
            ],
            "i": "micro-behaviors/fs/path/extension::dll-dup",
            "l": 2,
            "el": [
              "0x14f46"
            ]
          },
          {
            "c": 0.949999988079071,
            "d": "DigiCert timestamp certificate chain",
            "e": [
              "DigiCert SHA2 Assured ID Timestamping CA"
            ],
            "i": "micro-behaviors/data/embedded/certificate::digicert-timestamp-chain",
            "l": 2,
            "el": [
              "0x49efb"
            ]
          },
          {
            "c": 1.0,
            "d": "PE has RT_GROUP_ICON in resources list",
            "e": [
              "[RT_ICON, RT_GROUP_ICON, RT_VERSION]"
            ],
            "i": "metadata/binary/resource::pe-resource-group-icon-list",
            "l": 2,
            "el": [
              "value:pe.resource_types"
            ]
          },
          {
            "a": "T1027",
            "c": 0.8399999737739563,
            "d": "VB6 PE with three sections",
            "e": [
              "sections.count = 3.00"
            ],
            "i": "objectives/anti-static/obfuscation/payload/string-sparse::three-section-vb6-layout",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1140",
            "c": 0.8999999761581421,
            "d": "VB LateGet dispatch token",
            "e": [
              "LateGet"
            ],
            "i": "objectives/command-and-control/dropper/staging/embedded::vb-lateget-token",
            "l": 1,
            "m": "B0030",
            "el": [
              "0x152ae"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "PE standard runtime section",
            "e": [
              ".reloc"
            ],
            "i": "metadata/binary/section/names::pe-runtime-standard-section",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "SOCKS5 client greeting bytes",
            "e": [
              "05 01 00"
            ],
            "i": "micro-behaviors/communications/proxy/socks::socks5-version-greeting-bytes",
            "l": 1,
            "el": [
              "0x14725"
            ]
          },
          {
            "c": 0.699999988079071,
            "d": "PE ProductName metadata field",
            "e": [
              "ProductName"
            ],
            "i": "metadata/package/versioning::pe-productname-field",
            "l": 2,
            "el": [
              "0x49406"
            ]
          },
          {
            "c": 0.8500000238418579,
            "d": ".NET Framework reference",
            "e": [
              ".NETFramework,Version=v4.0"
            ],
            "i": "metadata/lang/compiler/managed::framework-reference",
            "l": 2,
            "el": [
              "0x205d7"
            ]
          },
          {
            "c": 0.949999988079071,
            "d": "PE ProductName field is populated",
            "e": [
              "比贼迪 丝迪弗"
            ],
            "i": "metadata/package/versioning::pe-product-name-present",
            "l": 1,
            "el": [
              "value:pe.version.product_name"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "mscorlib reference",
            "e": [
              "mscorlib"
            ],
            "i": "metadata/lang/compiler/managed::mscorlib",
            "l": 2,
            "el": [
              "0x14ba5"
            ]
          },
          {
            "c": 0.6000000238418579,
            "d": "SOCKS5 UDP ASSOCIATE request opcode",
            "e": [
              "05 03 00"
            ],
            "i": "micro-behaviors/communications/proxy/socks::socks5-udp-associate-byte",
            "l": 1,
            "el": [
              "0x20505"
            ]
          },
          {
            "c": 0.699999988079071,
            "d": "PE has many readable strings",
            "e": [
              "binary.string_count = 1030.00"
            ],
            "i": "metadata/binary/layout::many-readable-strings",
            "l": 2
          },
          {
            "c": 0.949999988079071,
            "d": "PE LegalCopyright field is populated",
            "e": [
              "© 弗艾比. All rights reserved."
            ],
            "i": "metadata/package/versioning::pe-legal-copyright-present",
            "l": 1,
            "el": [
              "value:pe.version.copyright"
            ]
          },
          {
            "c": 0.550000011920929,
            "d": ".NET Start method token",
            "e": [
              "Start"
            ],
            "i": "micro-behaviors/process/create/spawn::start-method-token-dotnet",
            "l": 1,
            "el": [
              "0x21be7"
            ]
          },
          {
            "c": 0.800000011920929,
            "d": "Regex component marker",
            "e": [
              "Strings",
              "ToString",
              "StringSplitOptions",
              "StringFileInfo"
            ],
            "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7",
            "l": 1,
            "el": [
              "0x15193",
              "0x14ec6",
              "0x151f5",
              "0x49276"
            ]
          },
          {
            "c": 0.8199999928474426,
            "d": "Repeated padding marker string block",
            "e": [
              "…XPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…",
              "PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…",
              "…XPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDING",
              "…XPADDINGPADDINGXXPADDINGPADDINGXXPADDING",
              "PADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…"
            ],
            "i": "objectives/anti-static/obfuscation/string/junking::repeated-padding-marker",
            "l": 1,
            "el": [
              "0x49510",
              "0x49510",
              "0x49510",
              "0x49510",
              "0x49510"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "PE standard code/data section",
            "e": [
              ".text"
            ],
            "i": "metadata/binary/section/names::pe-code-data-standard-section",
            "l": 1
          },
          {
            "c": 0.6499999761581421,
            "d": ".NET Diagnostics namespace token",
            "e": [
              "System.Diagnostics"
            ],
            "i": "micro-behaviors/process/create/spawn::diagnostics-namespace-token-dotnet",
            "l": 1,
            "el": [
              "0x150ef"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "PE file uses .exe extension",
            "e": [
              "c765be5e14f6ce6d171159c02234c09b4f1faa7292cdd7dc4f824eb35b77a24b.exe"
            ],
            "i": "metadata/binary/framework::exe-extension",
            "l": 1
          },
          {
            "a": "T1574.002",
            "c": 0.8999999761581421,
            "d": "Hidden LoadLibraryA string reference",
            "e": [
              "LoadLibraryA"
            ],
            "i": "micro-behaviors/dylib/load/runtime::load-library-a-string-no-import",
            "l": 1,
            "el": [
              "0x14b71"
            ]
          },
          {
            "a": "T1027",
            "c": 0.8600000143051147,
            "d": "Long mixed-case identifiers cluster",
            "e": [
              "NamedPipeServerStream",
              "AssemblyFileVersionAttribute",
              "ComVisibleAttribute",
              "AssemblyCopyrightAttribute",
              "ConfiguredTaskAwaitable",
              "AssemblyDescriptionAttribute",
              "AssemblyProductAttribute",
              "AssemblyCompanyAttribute",
              "TargetFrameworkAttribute",
              "AsyncTaskMethodBuilder",
              "AssemblyTitleAttribute",
              "CompilationRelaxationsAttribute",
              "AssemblyTrademarkAttribute",
              "ConfiguredTaskAwaiter",
              "FrameworkDisplayName"
            ],
            "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers",
            "l": 1,
            "m": "B0032",
            "el": [
              "0x218f4",
              "0x14db8",
              "0x14d59",
              "0x14e2b",
              "0x218b6",
              "0x14dd5",
              "0x14e12",
              "0x14e46",
              "0x14d9f",
              "0x21896",
              "0x14d6d",
              "0x14df2",
              "0x14d84",
              "0x218d7",
              "0x205f6"
            ]
          },
          {
            "a": "T1055",
            "c": 0.800000011920929,
            "d": "Executable section with very low entropy",
            "e": [
              ".text (size: 133120, perms: r-x)"
            ],
            "i": "objectives/anti-static/obfuscation/binary-structure::low-entropy-executable",
            "l": 1
          },
          {
            "c": 0.699999988079071,
            "d": "High string count over 1000",
            "e": [
              "binary.string_count = 1030.00"
            ],
            "i": "metadata/binary/metrics/threshold::high-string-count-1000",
            "l": 2
          },
          {
            "a": "T1027",
            "c": 0.800000011920929,
            "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)",
            "e": [
              "pe.resource_count = 4.00"
            ],
            "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources",
            "l": 1
          },
          {
            "a": "T1612",
            "c": 0.8500000238418579,
            "d": "PE has few icon resources",
            "e": [
              "pe.icon_count = 2.00"
            ],
            "i": "objectives/anti-static/obfuscation/payload/resource::icon-count-under-six",
            "l": 1,
            "m": "B0023"
          },
          {
            "a": "T1222.001",
            "c": 0.8999999761581421,
            "d": "Hidden VirtualProtect string reference",
            "e": [
              "VirtualProtect"
            ],
            "i": "micro-behaviors/mem/protect/modify::virtual-protect-text-pe",
            "l": 1,
            "el": [
              "0x1529f"
            ]
          },
          {
            "c": 1.0,
            "d": ".NET BSJB metadata marker",
            "e": [
              "BSJB"
            ],
            "i": "metadata/binary/framework::bsjb-marker",
            "l": 1
          },
          {
            "c": 0.949999988079071,
            "d": "Filename has EXE extension",
            "e": [
              "c765be5e14f6ce6d171159c02234c09b4f1faa7292cdd7dc4f824eb35b77a24b.exe"
            ],
            "i": "objectives/evasion/masquerade/file/double-ext::basename-is-exe",
            "l": 1
          },
          {
            "a": "T1053.005",
            "c": 0.8799999952316284,
            "d": "Regex component marker",
            "e": [
              "ContainsPath",
              "GetInstallationPath",
              "GetEnginePath",
              "GetInstanceForPath"
            ],
            "i": "objectives/persistence/login/scheduled-task/com::task-action-principal-properties--rx-5",
            "l": 1,
            "m": "F0012",
            "el": [
              "0x14f09",
              "0x14ee2",
              "0x14ed4",
              "0x14ef6"
            ]
          },
          {
            "c": 0.7200000286102295,
            "d": "WinForms Button control token",
            "e": [
              "Button"
            ],
            "i": "micro-behaviors/ui/controls/widget::winforms-button",
            "l": 1,
            "el": [
              "0x1503e"
            ]
          },
          {
            "a": "T1055",
            "c": 0.9200000166893005,
            "d": "Regex component marker",
            "e": [
              "imports.count = 1.00"
            ],
            "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571",
            "l": 1,
            "m": "C0041"
          },
          {
            "a": "T1105",
            "c": 0.800000011920929,
            "d": "Compact PE import table",
            "e": [
              "imports.count = 1.00"
            ],
            "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table",
            "l": 1,
            "m": "E1105"
          },
          {
            "c": 0.949999988079071,
            "d": "links mscoree (CorExeMain)",
            "e": [
              "mscoree"
            ],
            "i": "metadata/dylib::mscoree",
            "l": 2,
            "el": [
              "1 symbols"
            ]
          },
          {
            "c": 0.949999988079071,
            "d": "PE version numbers look like IPv4",
            "e": [
              "6.0.5.3",
              "3.0.2.7"
            ],
            "i": "metadata/package/versioning::version-number-ipv4-metadata",
            "l": 1,
            "el": [
              "value:pe.version.product_version",
              "value:pe.version.file_version"
            ]
          },
          {
            "a": "T1036.005",
            "c": 0.9399999976158142,
            "d": "Two dotted-quad version strings",
            "e": [
              "6.0.5.3",
              "3.0.2.7"
            ],
            "i": "objectives/evasion/masquerade/identity/fabricated::dotted-quad-version-pair",
            "l": 1,
            "el": [
              "value:pe.version.product_version",
              "value:pe.version.file_version"
            ]
          }
        ],
        "sha": "c765be5e14f6ce6d171159c02234c09b4f1faa7292cdd7dc4f824eb35b77a24b",
        "path": "/data/samples/bad/datasets/various/datalake.abuse.ch/2020-10/c765be5e14f6ce6d171159c02234c09b4f1faa7292cdd7dc4f824eb35b77a24b.exe",
        "type": "pe"
      }
    ],
    "tv": "ca5ef"
  }
}