{
  "ml": {
    "v": "4",
    "fs": [
      {
        "id": 0,
        "prob": 0.9815003871917725,
        "class": 1
      }
    ],
    "prob": 0.9815004,
    "class": 1,
    "oprob": 0.8850512,
    "oclass": 0,
    "version": "v16.16",
    "thresholds": [
      0.9815004,
      0.99404883
    ],
    "analyzed_at": "2026-05-01T19:02:47Z"
  },
  "path": "33495",
  "raw": {
    "v": "4",
    "fs": [
      {
        "f": "KO₃(AlAs₅C₃)H₂(CmPo)Md₃(Bi₈HeSi)",
        "x": 112,
        "id": 0,
        "is": [
          "RtlFillMemory",
          "GlobalAlloc",
          "lstrcatW",
          "VirtualFree",
          "Module32NextW",
          "PurgeComm",
          "VirtualFreeEx",
          "GetDefaultCommConfigA",
          "WriteProfileStringW",
          "Module32NextW",
          "lstrcmp",
          "CreateNamedPipeA",
          "GetProfileIntA"
        ],
        "ms": {
          "binary": {
            "code_size": 78336.0,
            "file_size": 122368.0,
            "wx_sections": 2.0,
            "import_count": 13.0,
            "string_count": 56.0,
            "section_count": 4.0,
            "avg_complexity": 1.0,
            "function_count": 1.0,
            "import_density": 0.17,
            "max_complexity": 1.0,
            "string_density": 0.73,
            "overall_entropy": 7.09,
            "avg_basic_blocks": 1.0,
            "avg_section_size": 30336.0,
            "function_density": 0.01,
            "avg_function_size": 9979.0,
            "avg_string_length": 8.34,
            "complexity_per_kb": 0.01,
            "max_string_length": 40.0,
            "writable_sections": 4.0,
            "avg_string_entropy": 2.39,
            "code_section_ratio": 0.5,
            "code_to_data_ratio": 1.82,
            "data_to_file_ratio": 0.35,
            "text_to_file_ratio": 0.11,
            "total_basic_blocks": 1.0,
            "executable_sections": 2.0,
            "section_name_entropy": 2.7,
            "string_length_stddev": 6.87,
            "largest_section_ratio": 0.53,
            "sentence_string_count": 1.0,
            "sentence_string_ratio": 0.02,
            "function_analysis_depth": 2.0,
            "has_malformed_structure": true,
            "normalized_import_count": 0.04,
            "normalized_section_count": 0.24,
            "nonstandard_section_name_count": 2.0
          }
        },
        "ss": [
          [
            77,
            "!This program cannot be run in DOS mode."
          ],
          [
            160,
            "Rich"
          ],
          [
            424,
            ".text"
          ],
          [
            464,
            ".rdata"
          ],
          [
            504,
            ".data"
          ],
          [
            544,
            ".brdata"
          ],
          [
            2786,
            "BLIC"
          ],
          [
            4743,
            "179.141.104.2:13275"
          ],
          [
            6054,
            "15.11.198.51:48384"
          ],
          [
            14474,
            "KERNEL32.dll"
          ],
          [
            14488,
            "teRtlFillMemory"
          ],
          [
            14505,
            "nsGlobalAlloc"
          ],
          [
            14520,
            "ntlstrcatW"
          ],
          [
            14533,
            "CVirtualFree"
          ],
          [
            14547,
            "QuModule32NextW"
          ],
          [
            14564,
            "uiPurgeComm"
          ],
          [
            14577,
            "atVirtualFreeEx"
          ],
          [
            14596,
            "GetDefaultCommConfigA"
          ],
          [
            14619,
            "yDWriteProfileStringW"
          ],
          [
            14659,
            "nalstrcmp"
          ],
          [
            14672,
            "CreateNamedPipeA"
          ],
          [
            14692,
            "GetProfileIntA"
          ],
          [
            15063,
            "/km4"
          ],
          [
            15443,
            "PCS0"
          ],
          [
            17032,
            "/yt6"
          ],
          [
            17097,
            "Eotc"
          ],
          [
            19990,
            "OB4A"
          ],
          [
            23020,
            "b0e0"
          ],
          [
            24296,
            "UFNAD"
          ],
          [
            26855,
            "YOMCV"
          ],
          [
            27425,
            "Thxn"
          ],
          [
            31950,
            "206.213.198.95:3505"
          ],
          [
            32199,
            "/3Jk"
          ],
          [
            36949,
            "59.213.31.115:46890"
          ],
          [
            42313,
            "Ltjx"
          ],
          [
            43537,
            "EASZ"
          ],
          [
            44792,
            "OTP3P"
          ],
          [
            47996,
            "Laez"
          ],
          [
            51317,
            "UOXP"
          ],
          [
            53286,
            "K37J"
          ],
          [
            53568,
            "IIW_L"
          ],
          [
            54079,
            "D_NR"
          ],
          [
            56818,
            "/RO0"
          ],
          [
            57471,
            "OXFB"
          ],
          [
            57663,
            "CDZ_"
          ],
          [
            58957,
            "Foxy"
          ],
          [
            59370,
            "2YFF"
          ],
          [
            62412,
            "GUZQK"
          ],
          [
            64725,
            "Oxrbf"
          ],
          [
            78516,
            "3KKKK"
          ],
          [
            78665,
            "6KLKK"
          ],
          [
            78758,
            "KKK6"
          ],
          [
            79405,
            "CSAY"
          ],
          [
            79971,
            "Z39KQ"
          ],
          [
            119462,
            "Jtmg"
          ],
          [
            120570,
            "UATJ"
          ]
        ],
        "sz": 122368,
        "ts": [
          {
            "a": "T1027",
            "c": 0.800000011920929,
            "d": "PE header too corrupted to parse: Malformed entity: Rich header does not contain the DanS marker",
            "e": [
              "Malformed entity: Rich header does not contain the DanS marker"
            ],
            "i": "objectives/anti-analysis/pe-tampering/corrupted-header",
            "l": 4,
            "m": "B0001"
          },
          {
            "c": 0.949999988079071,
            "d": "Random low-entropy RWX cavity section",
            "e": [
              ".text (size: 13824, entropy: 0.00, perms: -rwx)",
              ".brdata (size: 64512, entropy: 0.00, perms: -rwx)"
            ],
            "i": "metadata/binary/section/metrics::random-rwx-cavity-section",
            "l": 4
          },
          {
            "c": 0.800000011920929,
            "d": "PE with exactly four sections",
            "e": [
              "binary.section_count = 4.00"
            ],
            "i": "metadata/binary/metrics::four-section-pe",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Low function count metric",
            "e": [
              "binary.function_count = 1.00"
            ],
            "i": "metadata/binary/metrics/markers::low-function-count-marker",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.800000011920929,
            "d": "Very few functions for code section size",
            "e": [
              "binary.function_count = 1.00"
            ],
            "i": "objectives/anti-static/obfuscation/string/anomaly::low-function-large-code",
            "l": 1,
            "m": "B0032"
          },
          {
            "d": "Few detected functions (stub-like or analysis-limited)",
            "e": [
              "binary.function_count = 1.00"
            ],
            "i": "metadata/binary/metrics::no-functions",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "Binary is not position-independent (fixed load address)",
            "e": [
              "binary.is_pie = 0.00"
            ],
            "i": "metadata/hardening::no-pie",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "Binary has low average complexity",
            "e": [
              "binary.avg_complexity = 1.00"
            ],
            "i": "metadata/binary/metrics::avg-complexity-15-max",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "Binary has low average string entropy",
            "e": [
              "binary.avg_string_entropy = 2.39"
            ],
            "i": "metadata/binary/metrics::avg-string-entropy-4-max",
            "l": 2
          },
          {
            "c": 0.800000011920929,
            "d": "Very low code entropy, minimal code",
            "e": [
              "binary.code_entropy = 0.00"
            ],
            "i": "metadata/binary/resource::low-code-entropy",
            "l": 2
          },
          {
            "a": "T1105",
            "c": 1.0,
            "d": "Binary has high overall entropy",
            "e": [
              "binary.overall_entropy = 7.09"
            ],
            "i": "objectives/command-and-control/dropper/staging::high-entropy-binary",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "File is a compiled binary",
            "e": [
              "binary.file_size = 122368.00"
            ],
            "i": "metadata/binary/framework::is-binary",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "Low-entropy rdata section",
            "e": [
              ".rdata (entropy: 0.00)"
            ],
            "i": "metadata/binary/section/metrics::low-entropy-rdata-section",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "Free virtual memory",
            "e": [
              "VirtualFree"
            ],
            "i": "micro-behaviors/mem/protect/modify::virtual-free",
            "l": 2
          },
          {
            "d": ".dll extension reference",
            "e": [
              ".dll"
            ],
            "i": "micro-behaviors/fs/path/extension::dll-dup",
            "l": 2
          },
          {
            "c": 0.8500000238418579,
            "d": "Enumerate next module from snapshot",
            "e": [
              "Module32NextW",
              "Module32NextW"
            ],
            "i": "micro-behaviors/process/enumerate/snapshot::module32-next",
            "l": 3
          },
          {
            "c": 0.8999999761581421,
            "d": "Four section compact loader layout",
            "e": [
              "binary.section_count = 4.00"
            ],
            "i": "well-known/malware/trojan/elex/compact-signals::four-section-compact-loader",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Binary has 4 or fewer sections",
            "e": [
              "binary.section_count = 4.00"
            ],
            "i": "objectives/command-and-control/infrastructure/config::max-sections-4",
            "l": 1
          },
          {
            "c": 0.75,
            "d": "Binary exports no symbols",
            "e": [
              "binary.export_count = 0.00"
            ],
            "i": "metadata/binary/symbols::no-exports",
            "l": 1
          },
          {
            "c": 0.8199999928474426,
            "d": "rdata over 2.5 times text size",
            "e": [
              ".rdata",
              ".brdata",
              ".rdata+.brdata = 466.7% of .text (64512 / 13824 bytes)"
            ],
            "i": "metadata/binary/section/metrics::rdata-ratio-over-2pt5x",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "PE standard runtime section",
            "e": [
              ".rdata"
            ],
            "i": "metadata/binary/section/names::pe-runtime-standard-section",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "Multiple embedded MZ headers",
            "e": [
              "4D 5A",
              "4D 5A",
              "4D 5A"
            ],
            "i": "metadata/binary/layout::multiple-pe-embedded-loose",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "PE standard code/data section",
            "e": [
              ".text",
              ".data"
            ],
            "i": "metadata/binary/section/names::pe-code-data-standard-section",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Uses named pipe IPC APIs",
            "e": [
              "CreateNamedPipeA"
            ],
            "i": "micro-behaviors/communications/ipc/named-pipe::named-pipe-api-usage",
            "l": 2
          },
          {
            "c": 0.9900000095367432,
            "d": "Single-function packed stub layout",
            "e": [
              "binary.function_count = 1.00"
            ],
            "i": "well-known/malware/worm/mydoom::metric-function-count-1",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Writable and executable section (W^X violation)",
            "e": [
              ".text (size: 13824, perms: -rwx)",
              ".brdata (size: 64512, perms: -rwx)"
            ],
            "i": "metadata/hardening/memory::wx-section",
            "l": 3
          },
          {
            "c": 1.0,
            "d": "Binary is not digitally signed",
            "e": [
              "binary.has_signature = 0.00"
            ],
            "i": "metadata/signed::unsigned",
            "l": 2
          },
          {
            "a": "T1055",
            "c": 0.8999999761581421,
            "d": "Writable and executable sections (self-modifying",
            "e": [
              "binary.wx_sections = 2.00"
            ],
            "i": "objectives/anti-static/obfuscation/binary-metrics::wx-sections",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.8500000238418579,
            "d": "High overall file entropy (likely",
            "e": [
              "binary.overall_entropy = 7.09"
            ],
            "i": "objectives/anti-static/obfuscation/binary-metrics::high-overall-entropy",
            "l": 3,
            "m": "B0032"
          },
          {
            "a": "T1045",
            "c": 0.949999988079071,
            "d": "Multiple W+X sections (packer pattern)",
            "e": [
              "binary.wx_sections = 2.00"
            ],
            "i": "objectives/anti-static/obfuscation/binary-metrics::many-wx-sections",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.800000011920929,
            "d": "Binary lacks resource section entirely",
            "e": [
              "binary.rsrc_to_file_ratio = 0.00"
            ],
            "i": "metadata/binary/resource::no-resources",
            "l": 2
          },
          {
            "a": "T1027",
            "c": 0.9200000166893005,
            "d": "Zero-entropy executable section (carved/packed PE)",
            "e": [
              ".text (size: 13824, entropy: 0.00, perms: -rwx)",
              ".brdata (size: 64512, entropy: 0.00, perms: -rwx)"
            ],
            "i": "objectives/anti-static/obfuscation/binary-metrics::zero-entropy-executable-section",
            "l": 4,
            "m": "B0032"
          },
          {
            "a": "T1105",
            "c": 0.800000011920929,
            "d": "Compact PE import table",
            "e": [
              "binary.import_count = 13.00"
            ],
            "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table",
            "l": 1,
            "m": "E1105"
          },
          {
            "c": 0.8500000238418579,
            "d": "Low function count metric",
            "e": [
              "binary.function_count = 1.00"
            ],
            "i": "metadata/binary/anomaly::low-function-count-marker",
            "l": 1
          },
          {
            "c": 0.8500000238418579,
            "d": "PE with malformed section layout",
            "e": [
              "binary.has_malformed_structure = 1.00"
            ],
            "i": "metadata/binary/metrics::malformed-pe-structure",
            "l": 3
          },
          {
            "c": 0.7200000286102295,
            "d": "Writable .rdata section permissions",
            "e": [
              ".rdata (perms: -rw-)"
            ],
            "i": "metadata/binary/section/names::writable-rdata",
            "l": 3
          },
          {
            "c": 0.8999999761581421,
            "d": "Tiny C string section ratio",
            "e": [
              ".rdata",
              ".rdata = 0.0% of total (0 / 122368 bytes)"
            ],
            "i": "metadata/binary/section/metrics::tiny-cstring-section",
            "l": 1
          },
          {
            "a": "T1027.007",
            "c": 0.800000011920929,
            "d": "DLL name strings without LoadLibrary import",
            "e": [
              "binary.import_count = 13.00"
            ],
            "i": "objectives/anti-static/obfuscation/string/runtime-decrypt::dll-names-no-loadlibrary",
            "l": 1,
            "m": "B0032.014"
          },
          {
            "a": "T1559",
            "c": 0.699999988079071,
            "d": "CreateNamedPipe API call",
            "e": [
              "CreateNamedPipeA"
            ],
            "i": "micro-behaviors/communications/ipc/named-pipe::create-named-pipe",
            "l": 3
          },
          {
            "a": "T1027",
            "c": 0.8600000143051147,
            "d": "Long mixed-case identifiers cluster",
            "e": [
              "GetDefaultCommConfigA"
            ],
            "i": "objectives/anti-static/obfuscation/string::long-mixedcase-identifiers",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.75,
            "d": "Low average code complexity",
            "e": [
              "binary.avg_complexity = 1.00"
            ],
            "i": "metadata/binary/metrics::low-average-complexity",
            "l": 2
          },
          {
            "c": 0.4000000059604645,
            "d": "Very few basic blocks (analysis-limited or sparse)",
            "e": [
              "binary.total_basic_blocks = 1.00"
            ],
            "i": "metadata/binary/metrics::few-basic-blocks",
            "l": 2
          },
          {
            "a": "T1027",
            "c": 0.699999988079071,
            "d": "Oversized data section vs code",
            "e": [
              ".rdata",
              ".data",
              ".brdata",
              ".rdata+.data+.brdata = 777.8% of text (107520 / 13824 bytes)"
            ],
            "i": "objectives/anti-static/obfuscation/payload/section::oversized-data-section",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.800000011920929,
            "d": "PE executable is unsigned",
            "e": [
              "binary.has_signature = 0.00"
            ],
            "i": "metadata/signed::unsigned-pe-executable",
            "l": 3
          },
          {
            "c": 0.949999988079071,
            "d": "links KERNEL32.dll (RtlFillMemory, GlobalAlloc, lstrcatW, VirtualFree, Module32NextW, ... +8 more)",
            "e": [
              "KERNEL32.dll"
            ],
            "i": "metadata/dylib::kernel32/dll",
            "l": 2
          }
        ],
        "sha": "c8d428db828bc648b7ca975de5a0f8d4f72883714357d2f0bb7f2938744ddbef",
        "path": "33495",
        "type": "pe"
      }
    ],
    "tv": "feb13"
  }
}