{
  "ml": {
    "v": "7",
    "lvl": -1,
    "conf": 0,
    "mods": [
      {
        "cls": 0,
        "raw": 0.10524594,
        "rte": "az",
        "prob": 0.10524594
      },
      {
        "cls": 0,
        "raw": 0.08540985,
        "rte": "az/native",
        "prob": 0.08540985
      },
      {
        "cls": 0,
        "raw": 0.3363542,
        "rte": "az/pe",
        "prob": 0.3363542
      }
    ],
    "prob": 0.10524594,
    "files": [
      {
        "id": 0,
        "lvl": -1,
        "conf": 0,
        "prob": 0.10524594038724899,
        "type": "pe"
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-06-14T19:40:42Z"
  },
  "path": "ca7fdf31a61aaa1da2b04436ad86e7c21286e583fa1ecf213aba2ccda41ceb24.dll",
  "raw": {
    "v": "7",
    "tv": "061e3",
    "files": [
      {
        "id": 0,
        "ctx": [
          {
            "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000XbVHe4J\u0026m(0ji6Sa?dLD+]{51x(+zoA=kPhvqNb%vqY$3BrC47",
            "l": 0,
            "n": [
              {
                "c": 3,
                "d": "Packed binary process execution",
                "i": "objectives/anti-static/obfuscation/eval/loader::packed-binary-process-execution",
                "o": 0,
                "z": 27
              }
            ],
            "x": true
          },
          {
            "b": "00000000000000000000rG3iAs5z)]Op/-1OR8t00cPyXI+KRrEf+Z05B##1Iu=gh5oFeEf#fuw(Jgc\u0026t3CcpuDH4)09907GtW",
            "l": 1008,
            "n": [
              {
                "c": 3,
                "d": "Packed binary context",
                "i": "objectives/anti-static/obfuscation/eval/loader::packed-binary-context",
                "o": 1024,
                "z": 30
              }
            ],
            "x": true
          },
          {
            "b": "007N)0081300000000]qlU{WZwK{lEwnC/Si@?S*wNPW(o)7L?CThrfkMBe(wNPW(p\u0026ZF:wPI[",
            "l": 2146,
            "n": [
              {
                "c": 2,
                "d": "Close handle",
                "i": "micro-behaviors/process/create/spawn::close-handle-dup",
                "o": 2162,
                "z": 11
              }
            ],
            "x": true
          },
          {
            "b": "m}D^ovrlJVA=M8s000l8m}D^pz!a0bwKZxIwLMVJwKcp@@q//cy?m3@wLEq?wQ1gPY8(!\u0026BAg(gC%IAgZxa",
            "l": 2210,
            "n": [
              {
                "c": 2,
                "d": "Get module file path (ANSI)",
                "i": "micro-behaviors/os/module/load::get-module-filename-ansi",
                "o": 2226,
                "z": 18
              }
            ],
            "x": true
          },
          {
            "b": "BAhhezB1m5yH}K7wO:dTe[w^m0000000000002%n^m:Ju001z\u003c000310000000000",
            "l": 2278,
            "n": [
              {
                "c": 2,
                "d": ".dll extension reference",
                "i": "micro-behaviors/fs/path/extension::dll-dup",
                "o": 2294,
                "z": 4
              }
            ],
            "x": true
          },
          {
            "b": "qErv4pF%QYwK*xEo?!z{e[Gos08#J=pg3*-r7Fqn0000000000000000000000000",
            "l": 2571,
            "n": [
              {
                "c": 2,
                "d": ".exe extension reference",
                "i": "micro-behaviors/fs/path/extension::exe-dup",
                "o": 2587,
                "z": 4
              }
            ],
            "x": true
          },
          {
            "b": "0000000000000000000001YbgaohxwRzak?:1W\u0026P4L!.N8zSA\u003ccnEbcgbn?f00000000",
            "l": 3056,
            "n": [
              {
                "c": 2,
                "d": "PE .reloc section presence",
                "i": "metadata/binary/section/names::reloc-section-presence",
                "o": 3072,
                "z": 6
              }
            ],
            "x": true
          }
        ],
        "mol": "O(As)H(Po₂)",
        "sha": "ca7fdf31a61aaa1da2b04436ad86e7c21286e583fa1ecf213aba2ccda41ceb24",
        "fact": {
          "id": "pe",
          "imp": [
            [
              "kernel32",
              "CloseHandle"
            ],
            [
              "kernel32",
              "CreateMutexA"
            ],
            [
              "kernel32",
              "CreateProcessA"
            ],
            [
              "kernel32",
              "GetLastError"
            ],
            [
              "kernel32",
              "GetModuleFileNameA"
            ],
            [
              "kernel32",
              "ReleaseMutex"
            ],
            [
              "kernel32",
              "lstrcpyA"
            ],
            [
              "kernel32",
              "lstrlenA"
            ]
          ],
          "met": {
            "pe": {
              "checksum": 0.0,
              "checksum_valid": 0.0,
              "checksum_stripped": 1.0,
              "computed_checksum": 39897.0,
              "reloc_overhang_bytes": 480.0,
              "reloc_overhang_ratio": 0.94,
              "bss_like_section_count": 0.0,
              "section_overflow_count": 0.0,
              "misaligned_section_count": 0.0,
              "base_relocation_block_count": 1.0,
              "base_relocation_entry_count": 11.0
            },
            "file": {
              "size": 3584.0,
              "entropy": 2.55,
              "size_bytes": 3584.0
            },
            "binary": {
              "is_pie": 0.0,
              "code_entropy": 3.84,
              "data_entropy": 0.74,
              "string_count": 20.0,
              "overall_entropy": 2.55,
              "entropy_variance": 1.98,
              "avg_string_length": 11.4,
              "max_string_length": 40.0,
              "code_to_data_ratio": 0.67,
              "string_length_stddev": 7.67,
              "largest_section_ratio": 0.29,
              "sentence_string_count": 1.0,
              "sentence_string_ratio": 0.05,
              "high_entropy_string_count": 0.0
            },
            "imports": {
              "count": 8.0
            },
            "sections": {
              "count": 4.0,
              "code_size": 1024.0,
              "entropy_max": 3.84,
              "entropy_mean": 1.93,
              "name_entropy": 3.1,
              "writable_count": 1.0,
              "executable_count": 1.0,
              "nonstandard_count": 0.0,
              "executable_writable_count": 0.0
            },
            "dependencies": {
              "count": 1.0
            }
          },
          "sec": [
            [
              ".text",
              1024,
              1024,
              3.84,
              "r-x"
            ],
            [
              ".rdata",
              2048,
              512,
              2.7,
              "r--"
            ],
            [
              ".data",
              2560,
              512,
              0.74,
              "rw-"
            ],
            [
              ".reloc",
              3072,
              512,
              0.42,
              "r--"
            ]
          ],
          "str": [
            [
              77,
              "u8",
              "!This program cannot be run in DOS mode."
            ],
            [
              160,
              "u8",
              "Rich"
            ],
            [
              432,
              "u8",
              ".text"
            ],
            [
              511,
              "u8",
              "@.data"
            ],
            [
              552,
              "u8",
              ".reloc"
            ],
            [
              1027,
              "u8",
              "VWQSR"
            ],
            [
              1169,
              "u8",
              "SRVWQ"
            ],
            [
              2162,
              "u8",
              "CloseHandle"
            ],
            [
              2176,
              "u8",
              "CreateMutexA"
            ],
            [
              2192,
              "u8",
              "CreateProcessA"
            ],
            [
              2210,
              "u8",
              "GetLastError"
            ],
            [
              2226,
              "u8",
              "GetModuleFileNameA"
            ],
            [
              2248,
              "u8",
              "ReleaseMutex"
            ],
            [
              2264,
              "u8",
              "lstrcpyA"
            ],
            [
              2276,
              "u8",
              "lstrlenA"
            ],
            [
              2286,
              "u8",
              "kernel32.dll"
            ],
            [
              2344,
              "u8",
              "runner.dll"
            ],
            [
              2560,
              "u8",
              "\\/INTEL_CEDR_STORE"
            ],
            [
              2579,
              "u8",
              "eGgiMMOe.exe"
            ],
            [
              2592,
              "u8",
              "TION_PATH%"
            ]
          ],
          "val": {
            "file.stem": "ca7fdf31a61aaa1da2b04436ad86e7c21286e583fa1ecf213aba2ccda41ceb24",
            "pe.imphash": "b6f391375d741ab65301de3824d105be",
            "pe.machine": "i386",
            "pe.rich.key": 3127662106,
            "pe.rich.hash": "f3231f9c6e25d4359044b4ea56ed564e",
            "pe.subsystem": "windows_gui",
            "pe.timestamp": 1288815443,
            "file.basename": "ca7fdf31a61aaa1da2b04436ad86e7c21286e583fa1ecf213aba2ccda41ceb24.dll",
            "pe.image_base": 268435456,
            "pe.image_size": 20480,
            "pe.machine_id": 332,
            "pe.os_version": "4.0",
            "pe.entry_point": 4484,
            "pe.headers_size": 1024,
            "pe.entry_section": ".text",
            "pe.subsystem_raw": 2,
            "pe.file_alignment": 512,
            "pe.image_hash.sha1": "8f86e65eda15b63d2d504be97c88e7f33140116a",
            "pe.export_timestamp": 1288815443,
            "pe.image_hash.sha256": "2be657183be0b824041346dfbe7c5681614fca672fa9cfcbd8f88f07f9bfac01",
            "pe.image_hash.sha384": "ed730e79f8b3d21a94be4dc5aeb9d37336c530addf1fe4af82d6398d9dd9c9b99064c5267d6e3334f004f1da03b8ec65",
            "pe.image_hash.sha512": "c2179f869a88bdc220297f586912730bf7a1cd1b8360b5bee656b4658d68fa353ba16c280ef42cad1f0d095393940444262adaf441840e947ed6ce5b9f7d8b22",
            "pe.section_alignment": 4096,
            "pe.subsystem_version": "4.0",
            "pe.characteristics[0]": "executable_image",
            "pe.characteristics[1]": "32bit_machine",
            "pe.characteristics[2]": "dll",
            "pe.characteristics_raw": 8462,
            "pe.linker_major_version": 5,
            "pe.linker_minor_version": 12,
            "build.toolchain.compiler": "msvc",
            "pe.data_directories[0].rva": 8448,
            "pe.data_directories[1].rva": 8228,
            "pe.data_directories[2].rva": 16384,
            "pe.data_directories[3].rva": 8192,
            "pe.number_of_rva_and_sizes": 16,
            "pe.data_directories[0].name": "export",
            "pe.data_directories[0].size": 51,
            "pe.data_directories[1].name": "import",
            "pe.data_directories[1].size": 40,
            "pe.data_directories[2].name": "base_relocation",
            "pe.data_directories[2].size": 32,
            "pe.data_directories[3].name": "iat",
            "pe.data_directories[3].size": 36,
            "pe.rich.entries[0].build_id": 18,
            "pe.rich.entries[1].build_id": 19,
            "pe.rich.entries[0].use_count": 1,
            "pe.rich.entries[1].use_count": 12,
            "pe.coff.dos_header_pe_pointer": 184,
            "pe.rich.entries[0].product_id": 8444,
            "pe.rich.entries[1].product_id": 8078,
            "pe.base_relocations.block_count": 1,
            "pe.base_relocations.entry_count": 11,
            "pe.base_relocations.padding_count": 1
          }
        },
        "find": [
          {
            "id": "objectives/anti-static/pack/runtime::pe-import-count-under-10",
            "conf": 0.8999999761581421,
            "crit": 1,
            "desc": "PE has under ten imports"
          },
          {
            "id": "micro-behaviors/os/module/load::get-module-filename-ansi",
            "conf": 0.699999988079071,
            "crit": 2,
            "desc": "Get module file path (ANSI)"
          },
          {
            "id": "metadata/file/extension::dll-basename",
            "conf": 1.0,
            "crit": 2,
            "desc": "DLL filename extension present"
          },
          {
            "id": "metadata/file/extension::dll",
            "conf": 1.0,
            "crit": 2,
            "desc": "Windows DLL extension"
          },
          {
            "id": "metadata/binary/metrics/structural::four-section-pe",
            "conf": 0.800000011920929,
            "crit": 1,
            "desc": "PE with exactly four sections"
          },
          {
            "id": "objectives/anti-static/pack/section-anomaly::reloc-overhang-ratio-high",
            "atk": "T1027",
            "mbc": "B0032",
            "conf": 0.8999999761581421,
            "crit": 1,
            "desc": "Reloc section mostly non-relocation bytes"
          },
          {
            "id": "metadata/binary/section/metrics::tiny-data-section",
            "conf": 0.800000011920929,
            "crit": 1,
            "desc": "Tiny writable data section"
          },
          {
            "id": "micro-behaviors/fs/path/extension::dll-dup",
            "crit": 2,
            "desc": ".dll extension reference"
          },
          {
            "id": "metadata/binary/metrics/threshold::low-overall-entropy-binary",
            "conf": 0.8999999761581421,
            "crit": 1,
            "desc": "Binary has low overall entropy"
          },
          {
            "id": "micro-behaviors/os/exception/error-handling::get-last-error",
            "conf": 0.699999988079071,
            "crit": 2,
            "desc": "Get system error code"
          },
          {
            "id": "micro-behaviors/process/sync/mutex::create-mutex",
            "mbc": "C0042",
            "conf": 0.8999999761581421,
            "crit": 2,
            "desc": "CreateMutex API call"
          },
          {
            "id": "metadata/binary/section/names::pe-runtime-standard-section",
            "conf": 0.8999999761581421,
            "crit": 1,
            "desc": "PE standard runtime section"
          },
          {
            "id": "metadata/binary/framework::is-binary",
            "conf": 1.0,
            "crit": 1,
            "desc": "File is a compiled binary"
          },
          {
            "id": "micro-behaviors/process/sync/mutex::release-mutex",
            "mbc": "C0042",
            "conf": 0.800000011920929,
            "crit": 2,
            "desc": "ReleaseMutex API call"
          },
          {
            "id": "micro-behaviors/process/info/current::get-module-filename",
            "conf": 0.699999988079071,
            "crit": 2,
            "desc": "GetModuleFileName API call"
          },
          {
            "id": "micro-behaviors/fs/path/check::get-module-filename",
            "conf": 0.8500000238418579,
            "crit": 2,
            "desc": "Query current module path"
          },
          {
            "id": "metadata/binary/section/names::pe-code-data-standard-section",
            "conf": 0.8999999761581421,
            "crit": 1,
            "desc": "PE standard code/data section"
          },
          {
            "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal",
            "conf": 0.699999988079071,
            "crit": 1,
            "desc": ".NET code entropy in unpacked range"
          },
          {
            "id": "objectives/anti-static/obfuscation/payload/string-sparse::low-string-count-vb6",
            "atk": "T1027",
            "mbc": "B0032",
            "conf": 0.8999999761581421,
            "crit": 1,
            "desc": "VB6 binary with very few strings"
          },
          {
            "id": "metadata/binary/section/names::reloc-section-presence",
            "conf": 0.8999999761581421,
            "crit": 2,
            "desc": "PE .reloc section presence"
          },
          {
            "id": "metadata/binary/anomaly/format::version-info-company-name-absent",
            "conf": 0.800000011920929,
            "crit": 1,
            "desc": "CompanyName field absent from PE version info"
          },
          {
            "id": "metadata/binary/layout::low-overall-entropy",
            "conf": 0.699999988079071,
            "crit": 2,
            "desc": "PE has low overall entropy"
          },
          {
            "id": "metadata/binary/section/metrics::low-entropy-rdata-section",
            "conf": 0.800000011920929,
            "crit": 1,
            "desc": "Low-entropy rdata section"
          },
          {
            "id": "micro-behaviors/process/create/spawn::close-handle-dup",
            "conf": 0.8999999761581421,
            "crit": 2,
            "desc": "Close handle"
          },
          {
            "id": "objectives/anti-static/pack/upx::no-compression-grade-section",
            "atk": "T1027.002",
            "mbc": "F0001.008",
            "conf": 0.8999999761581421,
            "crit": 1,
            "desc": "No section reaches compression-grade entropy"
          },
          {
            "id": "metadata/package/files::dll-extension-basename",
            "conf": 0.949999988079071,
            "crit": 1,
            "desc": "Filename ends with .dll"
          },
          {
            "id": "micro-behaviors/process/create/spawn::create-process-a",
            "atk": "T1106",
            "conf": 0.949999988079071,
            "crit": 3,
            "desc": "Create process (ANSI)"
          },
          {
            "id": "objectives/impact/destroy/file-deletion::exe-gho-bak-whitelist",
            "atk": "T1485",
            "mbc": "C0047",
            "conf": 0.8999999761581421,
            "crit": 1,
            "desc": "Preserves .exe .gho .bak files"
          },
          {
            "id": "objectives/anti-static/obfuscation/string/runtime-decrypt::dll-names-no-loadlibrary",
            "atk": "T1027.007",
            "mbc": "B0032.014",
            "conf": 0.800000011920929,
            "crit": 1,
            "desc": "DLL name strings without LoadLibrary import"
          },
          {
            "id": "objectives/evasion/masquerade/cert::pe-no-version-info-resource",
            "atk": "T1553.002",
            "conf": 0.8500000238418579,
            "crit": 1,
            "desc": "PE lacks VS_VERSION_INFO resource"
          },
          {
            "id": "objectives/command-and-control/infrastructure/config::max-sections-4",
            "conf": 1.0,
            "crit": 1,
            "desc": "Binary has 4 or fewer sections"
          },
          {
            "id": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers",
            "atk": "T1027",
            "mbc": "B0032",
            "conf": 0.8600000143051147,
            "crit": 1,
            "desc": "Long mixed-case identifiers cluster"
          },
          {
            "id": "objectives/evasion/process/injection/hollowing::create-process-string",
            "atk": "T1055.012",
            "mbc": "E1055.012",
            "conf": 0.800000011920929,
            "crit": 1,
            "desc": "Spawns process to host injected code"
          },
          {
            "id": "micro-behaviors/os/api-resolution/manual::kernel32-resolver",
            "atk": "T1027.007",
            "conf": 0.8999999761581421,
            "crit": 1,
            "desc": "Kernel32 DLL resolution string"
          },
          {
            "id": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table",
            "atk": "T1105",
            "mbc": "E1105",
            "conf": 0.800000011920929,
            "crit": 1,
            "desc": "Compact PE import table"
          },
          {
            "id": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571",
            "atk": "T1055",
            "mbc": "C0041",
            "conf": 0.9200000166893005,
            "crit": 1,
            "desc": "Regex component marker"
          },
          {
            "id": "micro-behaviors/fs/path/extension::exe-dup",
            "crit": 2,
            "desc": ".exe extension reference"
          },
          {
            "id": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text",
            "atk": "T1055",
            "conf": 0.949999988079071,
            "crit": 1,
            "desc": "Huge null run in executable (128+ bytes)"
          },
          {
            "id": "objectives/anti-static/obfuscation/eval/loader::packed-binary-context",
            "atk": "T1027",
            "mbc": "B0032",
            "conf": 0.8500000238418579,
            "crit": 3,
            "desc": "Packed binary context"
          },
          {
            "id": "micro-behaviors/process/sync/mutex::mutex-api",
            "mbc": "C0042",
            "conf": 0.8500000238418579,
            "crit": 2,
            "desc": "Mutex creation/access API"
          },
          {
            "id": "micro-behaviors/process/create/shell/invoke::win-createprocess",
            "atk": "T1059.003",
            "mbc": "E1059.003",
            "conf": 0.8999999761581421,
            "crit": 3,
            "desc": "Creates new process via Windows API"
          },
          {
            "id": "micro-behaviors/process/create/shell/invoke::shell-execution-comp",
            "atk": "T1059",
            "mbc": "E1059",
            "conf": 0.8999999761581421,
            "crit": 3,
            "desc": "Shell command execution capability detected"
          },
          {
            "id": "micro-behaviors/process/sync/mutex::mutex-instance-check",
            "mbc": "C0042",
            "conf": 0.800000011920929,
            "crit": 2,
            "desc": "Mutex-based single instance enforcement"
          },
          {
            "id": "objectives/anti-static/obfuscation/eval/loader::binary-process-execution",
            "atk": "T1027",
            "mbc": "B0032",
            "conf": 0.8500000238418579,
            "crit": 3,
            "desc": "Binary process execution capability"
          },
          {
            "id": "objectives/anti-static/obfuscation/eval/loader::packed-binary-process-execution",
            "atk": "T1027",
            "mbc": "B0032",
            "conf": 0.8999999761581421,
            "crit": 3,
            "desc": "Packed binary process execution"
          }
        ],
        "path": "ca7fdf31a61aaa1da2b04436ad86e7c21286e583fa1ecf213aba2ccda41ceb24.dll",
        "risk": 4,
        "size": 3584,
        "type": "pe"
      }
    ]
  }
}